{
    "apiVersion": "v1",
    "items": [
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/commit_sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wsynwn",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4/records/c9d3600e-668b-4d54-8ac5-c695af2bac95",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-multi-component-child-suum"
                },
                "creationTimestamp": "2026-08-13T08:22:16Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:57Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-pull-request-b9456",
                    "tekton.dev/pipelineRunUID": "8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "f77ac87106ad2d9dbd1f2d442db15162ad8b430f08b29764a477fefe5fa8f9"
                },
                "name": "fj-214fdfe6a34fca32e31a5c0a2a6a9f98-deprecated-base-image-check",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-pull-request-b9456",
                        "uid": "8a58744a-92ae-4abd-9f78-08a68ab104e4"
                    }
                ],
                "resourceVersion": "29350",
                "uid": "c9d3600e-668b-4d54-8ac5-c695af2bac95"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:22:29Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:22:29Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-214fdfe6a34fca32e31a5c0a1ba5fc41cbcfe75a595c62fef6fe6cda-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\", \"digests\": [\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-08-13T08:22:28+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "startTime": "2026-08-13T08:22:16Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://fc7c8a3817912ee3aaeb5a9717f39dde6b9d2ee03a69f551a37a08d02937d8be",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:28Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\\\", \\\"digests\\\": [\\\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:28+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:21Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=\"/tmp/sbom-${arch}.json\"\n    arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n    # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n    mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n    export DOCKER_CONFIG=/tmp/auth\n\n    # Get base images from SBOM\n    if ! cosign download sbom \"$arch_imageanddigest\" \u003e \"${SBOM_FILE_PATH}\"; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo \"$IMAGE_WITH_TAG\" | cut -d \":\" -f1 \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c \"$BASE_IMAGE\"\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=\"/tmp/${IMAGE_REPOSITORY}\"\n  mkdir -p \"${IMAGE_REPO_PATH}\"\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o \"${IMAGE_REPO_PATH}/repository_data.json\" -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail \"${IMAGE_REPO_PATH}/repository_data.json\" \\\n    --policy \"$POLICY_DIR\" --namespace \"$POLICY_NAMESPACE\" \\\n    --output=json | tee \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\"\n\n    failures_num=$(jq -r '.[].failures|length' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/commit_sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xyhwgy",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-child-suum' (#1) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42/records/41a439a2-7ced-42b2-8731-2bde0637f9d5",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:03Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:32:00Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-x6hbt",
                    "tekton.dev/pipelineRunUID": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check"
                },
                "name": "fj-a41adb77fdef5c99f9f31aea076d0dcb-deprecated-base-image-check",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-x6hbt",
                        "uid": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42"
                    }
                ],
                "resourceVersion": "29406",
                "uid": "41a439a2-7ced-42b2-8731-2bde0637f9d5"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:15Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:15Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-a41adb77fdef5c99f9f31aea078bdd9c796f072004fd2728523a1e17-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\", \"digests\": [\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-08-13T08:27:14+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:03Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://3488db06202e42cedbcc78344e07185fc576f3d2003773f4440142527e3b97e9",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:14Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\\\", \\\"digests\\\": [\\\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:14+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:07Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=\"/tmp/sbom-${arch}.json\"\n    arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n    # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n    mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n    export DOCKER_CONFIG=/tmp/auth\n\n    # Get base images from SBOM\n    if ! cosign download sbom \"$arch_imageanddigest\" \u003e \"${SBOM_FILE_PATH}\"; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo \"$IMAGE_WITH_TAG\" | cut -d \":\" -f1 \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c \"$BASE_IMAGE\"\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=\"/tmp/${IMAGE_REPOSITORY}\"\n  mkdir -p \"${IMAGE_REPO_PATH}\"\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o \"${IMAGE_REPO_PATH}/repository_data.json\" -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail \"${IMAGE_REPO_PATH}/repository_data.json\" \\\n    --policy \"$POLICY_DIR\" --namespace \"$POLICY_NAMESPACE\" \\\n    --output=json | tee \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\"\n\n    failures_num=$(jq -r '.[].failures|length' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/commit_sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-chgcms",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'updated to build repo image' (#2) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87/records/e3dbc0ce-5952-4c0b-bbbf-053227b6e30e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:25Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-rqwtf",
                    "tekton.dev/pipelineRunUID": "a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check"
                },
                "name": "fj-cdea178a5e07a5b7c043a494ddf18f6d-deprecated-base-image-check",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-rqwtf",
                        "uid": "a5c45622-3b94-4222-aa59-e9e38de19b87"
                    }
                ],
                "resourceVersion": "29314",
                "uid": "e3dbc0ce-5952-4c0b-bbbf-053227b6e30e"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:38Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:38Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-cdea178a5e07a5b7c043a494c237a531b92f0a0a57ea5ea7ffa6b915-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\", \"digests\": [\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-08-13T08:27:38+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:25Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://6837284f27cfbb6f5f115ab0334a276873253f695e3fd632c6f599d02af93e27",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:38Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\\\", \\\"digests\\\": [\\\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:38+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:30Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=\"/tmp/sbom-${arch}.json\"\n    arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n    # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n    mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n    export DOCKER_CONFIG=/tmp/auth\n\n    # Get base images from SBOM\n    if ! cosign download sbom \"$arch_imageanddigest\" \u003e \"${SBOM_FILE_PATH}\"; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo \"$IMAGE_WITH_TAG\" | cut -d \":\" -f1 \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c \"$BASE_IMAGE\"\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=\"/tmp/${IMAGE_REPOSITORY}\"\n  mkdir -p \"${IMAGE_REPO_PATH}\"\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o \"${IMAGE_REPO_PATH}/repository_data.json\" -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail \"${IMAGE_REPO_PATH}/repository_data.json\" \\\n    --policy \"$POLICY_DIR\" --namespace \"$POLICY_NAMESPACE\" \\\n    --output=json | tee \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\"\n\n    failures_num=$(jq -r '.[].failures|length' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/commit_sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wsynwn",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4/records/1b67bb3f-c434-47e9-a522-fe065a27029a",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-multi-component-child-suum"
                },
                "creationTimestamp": "2026-08-13T08:19:42Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:57Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-pull-request-b9456",
                    "tekton.dev/pipelineRunUID": "8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "f77ac87106ad2d9dbd1f2d442db15162ad8b430f08b29764a477fefe5fa8f9"
                },
                "name": "fj-multi-214fdfe6a34fca32e31a5c0a2a6a9f98-prefetch-dependencies",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-pull-request-b9456",
                        "uid": "8a58744a-92ae-4abd-9f78-08a68ab104e4"
                    }
                ],
                "resourceVersion": "29348",
                "uid": "1b67bb3f-c434-47e9-a522-fe065a27029a"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "5d"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3.2@sha256:7f344093a3387d05eeedad1f929743e197212b50ee95ceaebdc74bbe5df05d03"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-wsynwn"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:20:22Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:20:22Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-214fdfe6a34fca32e36aff5561dfc688457b83e9356987deab-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7f344093a3387d05eeedad1f929743e197212b50ee95ceaebdc74bbe5df05d03"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2"
                    }
                ],
                "startTime": "2026-08-13T08:19:46Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:1bc3c5c15720506a0cf48adfdf8b623dfe704377e007d7bbae8d14876392ca6a",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://d68d1600080116cddcb2018de6228ca964558efaa58874eecb41f0178fc5b6c5",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:19:53Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:19:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://63b4060d45d8cc9ba453075e90350695edae1f7055351e3b28c7bd855581bfe8",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:19:54Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:19:54Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:27936b01262824104cce87d433ffcb622bf906bc833033b6b05c62257f3c3232",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://f6568108e676e3a4d7b87022837359977985b741fcdaf431bbdb3c11d45c420c",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:20:22Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:19:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://fec5427f330a402a7a9ffabbe36c90c6a947f6f8cee188a79402f24301299299",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:20:22Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:20:22Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.8-1781496742@sha256:1bc3c5c15720506a0cf48adfdf8b623dfe704377e007d7bbae8d14876392ca6a",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.55.0@sha256:27936b01262824104cce87d433ffcb622bf906bc833033b6b05c62257f3c3232",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\n  # requests ignores the system CA store. Set REQUESTS_CA_BUNDLE explicitly.\n  export REQUESTS_CA_BUNDLE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "5d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/commit_sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-qctpiq",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-parent-suum' (#1) from konflux-fj-multi-component-parent-suum into multi-component-parent-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077/records/dab75d8f-3e6d-4779-840f-abc1698c23bb",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-jybppk\",\"commit\":\"4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux"
                },
                "creationTimestamp": "2026-08-13T08:24:57Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-parent-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-parent-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-parent-suum-on-push-z5mgc",
                    "tekton.dev/pipelineRunUID": "4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min"
                },
                "name": "fj-multi-50cd292242b5c55aa32d47d182d36eb9-prefetch-dependencies",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-parent-suum-on-push-z5mgc",
                        "uid": "4293ea80-6fa0-4667-8c9b-d77eeb295077"
                    }
                ],
                "resourceVersion": "29107",
                "uid": "dab75d8f-3e6d-4779-840f-abc1698c23bb"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-parent-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3.2@sha256:7f344093a3387d05eeedad1f929743e197212b50ee95ceaebdc74bbe5df05d03"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-qctpiq"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:25:33Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:25:33Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-50cd292242b5c55aa35bd2d6d46d9db5e6709ae207d3e1f92d-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7f344093a3387d05eeedad1f929743e197212b50ee95ceaebdc74bbe5df05d03"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9"
                    }
                ],
                "startTime": "2026-08-13T08:24:58Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:1bc3c5c15720506a0cf48adfdf8b623dfe704377e007d7bbae8d14876392ca6a",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://7a062918a649715ac8d155cf7d0c2b9b166319420d32250365c1857aa973b436",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:03Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:03Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://2084a27622fce7e9bdf6bb3f4ad20310514d330c4f187695b0ae37a3a66a7f37",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:03Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:03Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:27936b01262824104cce87d433ffcb622bf906bc833033b6b05c62257f3c3232",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://1f13196cfbbf2115c53de67f90cce01e7d3312db6043f5e37c548fe3648ef88b",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:31Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:04Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://a1216275fe0f957b0ea02dd286ad3160ca6deac353343e2466a776566b336a2e",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:32Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:32Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.8-1781496742@sha256:1bc3c5c15720506a0cf48adfdf8b623dfe704377e007d7bbae8d14876392ca6a",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.55.0@sha256:27936b01262824104cce87d433ffcb622bf906bc833033b6b05c62257f3c3232",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\n  # requests ignores the system CA store. Set REQUESTS_CA_BUNDLE explicitly.\n  export REQUESTS_CA_BUNDLE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/commit_sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xyhwgy",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-child-suum' (#1) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42/records/f8f96d70-50e8-4e7c-9fb9-450c9ab08464",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux"
                },
                "creationTimestamp": "2026-08-13T08:24:32Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:32:00Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-x6hbt",
                    "tekton.dev/pipelineRunUID": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min"
                },
                "name": "fj-multi-a41adb77fdef5c99f9f31aea076d0dcb-prefetch-dependencies",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-x6hbt",
                        "uid": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42"
                    }
                ],
                "resourceVersion": "29411",
                "uid": "f8f96d70-50e8-4e7c-9fb9-450c9ab08464"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3.2@sha256:7f344093a3387d05eeedad1f929743e197212b50ee95ceaebdc74bbe5df05d03"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-xyhwgy"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:25:07Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:25:07Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-a41adb77fdef5c99f9be433cd13cd45ec5efac408ece20ec93-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7f344093a3387d05eeedad1f929743e197212b50ee95ceaebdc74bbe5df05d03"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b"
                    }
                ],
                "startTime": "2026-08-13T08:24:32Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:1bc3c5c15720506a0cf48adfdf8b623dfe704377e007d7bbae8d14876392ca6a",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5cfca018573fc6d070a668d2a05550d0dfed1b4dadaf074ae4370825a940535f",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:24:37Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:24:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://c36d7d3daffa14f35dc81e44d8962517b9273142206915100ec4d737ad1ee256",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:24:37Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:24:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:27936b01262824104cce87d433ffcb622bf906bc833033b6b05c62257f3c3232",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://a2bd4141a97b19ac4408d88585c76d7b79b816b3decdb59511561bea6eb226b6",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:05Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:24:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://6bdc23941fb77a154818cc2fc99dc45ea18ba6e404def3529732e1be90f4ee84",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:06Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.8-1781496742@sha256:1bc3c5c15720506a0cf48adfdf8b623dfe704377e007d7bbae8d14876392ca6a",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.55.0@sha256:27936b01262824104cce87d433ffcb622bf906bc833033b6b05c62257f3c3232",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\n  # requests ignores the system CA store. Set REQUESTS_CA_BUNDLE explicitly.\n  export REQUESTS_CA_BUNDLE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/commit_sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-chgcms",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'updated to build repo image' (#2) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87/records/c78d5a65-eda5-41de-bee4-1368eb51e106",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux"
                },
                "creationTimestamp": "2026-08-13T08:24:55Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-rqwtf",
                    "tekton.dev/pipelineRunUID": "a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min"
                },
                "name": "fj-multi-cdea178a5e07a5b7c043a494ddf18f6d-prefetch-dependencies",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-rqwtf",
                        "uid": "a5c45622-3b94-4222-aa59-e9e38de19b87"
                    }
                ],
                "resourceVersion": "29304",
                "uid": "c78d5a65-eda5-41de-bee4-1368eb51e106"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3.2@sha256:7f344093a3387d05eeedad1f929743e197212b50ee95ceaebdc74bbe5df05d03"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-chgcms"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:25:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:25:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-cdea178a5e07a5b7c05724d3b8793e2b94003aeef43016130d-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7f344093a3387d05eeedad1f929743e197212b50ee95ceaebdc74bbe5df05d03"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd"
                    }
                ],
                "startTime": "2026-08-13T08:24:55Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:1bc3c5c15720506a0cf48adfdf8b623dfe704377e007d7bbae8d14876392ca6a",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://7768b5fe298018a5113b5de22a0fe92095b820c73c17fb7e76270350c3e12006",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:01Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://b2c15db4958c5a012a2f72b49bc402ebef4673fcf45c0fae08477703df5371ce",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:01Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:01Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:27936b01262824104cce87d433ffcb622bf906bc833033b6b05c62257f3c3232",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://489f5185c5d596ab4bc6317393a91d264fbe30b07c15aa034df27deb56702e4e",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:29Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:02Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://fdbc3376bfb1019c91c16707b8a365982e8363ef09a417b02fb2de6f4ca5a22d",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:30Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:30Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.8-1781496742@sha256:1bc3c5c15720506a0cf48adfdf8b623dfe704377e007d7bbae8d14876392ca6a",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.55.0@sha256:27936b01262824104cce87d433ffcb622bf906bc833033b6b05c62257f3c3232",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\n  # requests ignores the system CA store. Set REQUESTS_CA_BUNDLE explicitly.\n  export REQUESTS_CA_BUNDLE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/commit_sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wsynwn",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4/records/3d3d4bb4-e7ce-4956-9fb8-beb450f30419",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "results.tekton.dev/stored": "true",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-multi-component-child-suum"
                },
                "creationTimestamp": "2026-08-13T08:22:16Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:57Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-pull-request-b9456",
                    "tekton.dev/pipelineRunUID": "8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "f77ac87106ad2d9dbd1f2d442db15162ad8b430f08b29764a477fefe5fa8f9"
                },
                "name": "fj-multi-co214fdfe6a34fca32e31a5c0a2a6a9f98-rpms-signature-scan",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-pull-request-b9456",
                        "uid": "8a58744a-92ae-4abd-9f78-08a68ab104e4"
                    }
                ],
                "resourceVersion": "29357",
                "uid": "3d3d4bb4-e7ce-4956-9fb8-beb450f30419"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:ccb77d1bf7627fc6241a59ed42bb6e5707a8682754fe8ae18f2cfdddbcf29275"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:22:58Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:22:58Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-co214fdfe6a34fca32635bbf769cd3081cb3457f217fc236b5-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ccb77d1bf7627fc6241a59ed42bb6e5707a8682754fe8ae18f2cfdddbcf29275"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\", \"digests\": [\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:22:56+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:22:18Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:816a2ad35037f3233903278371f766102735f96cfaf48a9663ce5b858cec34b3",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://ffa108e2041c0025bdfc51ef2dff733f526b92603d19d965f580ba27236c485c",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:55Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://348e3afa4a9a0b50c1dddcab418b12e425d27e39c763cfe8cad96c303886d251",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:56Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\\\", \\\"digests\\\": [\\\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:56+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:56Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:816a2ad35037f3233903278371f766102735f96cfaf48a9663ce5b858cec34b3",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/commit_sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wsynwn",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4/records/d356c625-e8a3-499e-914b-c1a2a27dc5f1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-multi-component-child-suum"
                },
                "creationTimestamp": "2026-08-13T08:22:16Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:57Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-pull-request-b9456",
                    "tekton.dev/pipelineRunUID": "8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "f77ac87106ad2d9dbd1f2d442db15162ad8b430f08b29764a477fefe5fa8f9"
                },
                "name": "fj-multi-com214fdfe6a34fca32e31a5c0a2a6a9f98-sast-unicode-check",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-pull-request-b9456",
                        "uid": "8a58744a-92ae-4abd-9f78-08a68ab104e4"
                    }
                ],
                "resourceVersion": "29353",
                "uid": "d356c625-e8a3-499e-914b-c1a2a27dc5f1"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:80bf85aebf99a9d26c2d3fae3d90ee6bfe28246e3b0bbd950934ceba764bc067"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:22:53Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:22:53Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-com214fdfe6a34fca3970bb1ce5e19e6f47da999ac1d7c3853-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "80bf85aebf99a9d26c2d3fae3d90ee6bfe28246e3b0bbd950934ceba764bc067"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:22:50+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:22:16Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://a03279555c14a6b57ec0ae79b763d88e510e5fb96dd20758f7fd5b2724975356",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://e4e812691a15f0d772795e1c4734807d34bd8ad7eee613209ed3ec7d64ddf066",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:50Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:50+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://7b5462d7b916f2acb0f2ff54b6ef47686bdd45b1d614c6a8f0bb2eeb4d240698",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:52Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:50+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/commit_sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wsynwn",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4/records/f9f5e7b7-33ea-4f2b-b9f2-f4e08b4e1f0e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-multi-component-child-suum"
                },
                "creationTimestamp": "2026-08-13T08:22:08Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:57Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-pull-request-b9456",
                    "tekton.dev/pipelineRunUID": "8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min",
                    "test.appstudio.openshift.io/pr-group-sha": "f77ac87106ad2d9dbd1f2d442db15162ad8b430f08b29764a477fefe5fa8f9"
                },
                "name": "fj-multi-comp214fdfe6a34fca32e31a5c0a2a6a9f98-build-image-index",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-pull-request-b9456",
                        "uid": "8a58744a-92ae-4abd-9f78-08a68ab104e4"
                    }
                ],
                "resourceVersion": "29362",
                "uid": "f9f5e7b7-33ea-4f2b-b9f2-f4e08b4e1f0e"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3.1@sha256:70679b88f57130e9a939a6765aacd976a9d66bfa5d1733fcee185dc07be39042"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:22:16Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:22:16Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-comp214fdfe6a34fca7335959d978142fc43a3aa0cf5aa16bd-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "70679b88f57130e9a939a6765aacd976a9d66bfa5d1733fcee185dc07be39042"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    }
                ],
                "startTime": "2026-08-13T08:22:08Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5c2e0182dca411b20ef7bbdaeb0b93dce42a7886f04fa1455bc0cc7ddda200d4",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:13Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://bc52f12cae6d251f90e6e6758bfc211bf50a8df8169b4912ae808e04739b015f",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:13Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://2702e962d64720de7a21667fb0f39099ad4592e149716d01b271174c3cbe6d84",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:15Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:13Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "false"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"fj-multi-comp214fdfe6a34fca32e31a5c0a2a6a9f98-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.1-1782136886@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/commit_sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wsynwn",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4/records/7c0760ce-b480-4914-9e5b-31ab8aecfa14",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-multi-component-child-suum"
                },
                "creationTimestamp": "2026-08-13T08:19:24Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:57Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-pull-request-b9456",
                    "tekton.dev/pipelineRunUID": "8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "f77ac87106ad2d9dbd1f2d442db15162ad8b430f08b29764a477fefe5fa8f9"
                },
                "name": "fj-multi-compo214fdfe6a34fca32e31a5c0a2a6a9f98-clone-repository",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-pull-request-b9456",
                        "uid": "8a58744a-92ae-4abd-9f78-08a68ab104e4"
                    }
                ],
                "resourceVersion": "29369",
                "uid": "7c0760ce-b480-4914-9e5b-31ab8aecfa14"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                    },
                    {
                        "name": "revision",
                        "value": "d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "5d"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.2.4@sha256:f90deac0d63b43c7cb3f0b2d83ee56aa7fa18bb493f084286c6a953bbf479d8d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-wsynwn"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:19:41Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:19:41Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-compo214fdfe6a34fcba3e42231a651c6c06847f293ff92a72-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "f90deac0d63b43c7cb3f0b2d83ee56aa7fa18bb493f084286c6a953bbf479d8d"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1786607585"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "d704fe2"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2"
                    }
                ],
                "startTime": "2026-08-13T08:19:24Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:fddbb4c2edb01a3f0065321f84cf2e4d8e483b4149e3d6f78dd0c46e85e35aef",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5d77d1c58765dcf17cb6b334bef73495b1e57149b71138a140fc0980a209da4d",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:19:38Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-child-jybppk\",\"type\":1},{\"key\":\"commit\",\"value\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1786607585\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"d704fe2\",\"type\":1},{\"key\":\"url\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-child-jybppk\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:19:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://784b5db670460061131506d30f94efebac8c8d6a7db9aa999eb4d7d38594b49b",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:19:41Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-child-jybppk\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2\",\"type\":1},{\"key\":\"commit\",\"value\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1786607585\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"d704fe2\",\"type\":1},{\"key\":\"url\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-child-jybppk\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:19:39Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level for the git-clone command.",
                            "name": "logLevel",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Minimum length of the short commit SHA. Git may return a longer prefix if needed for uniqueness.",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched. Empty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "CSV list of path patterns to exclude from the symlink check. Symlinks whose paths match\nare not checked. Patterns are relative to the checkout directory and must not start with '/'.\nUse '*' and '?' as wildcards ('*' matches across '/').\nQuote patterns containing commas using CSV double quotes.\n",
                            "name": "symlinkCheckIgnorePattern",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "Abbreviated commit SHA for the checkout. At least params.shortCommitLength characters; longer if Git requires more for uniqueness.",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_GIT_CLONE_URL",
                                    "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_REVISION",
                                    "value": "d704fe2e1a443a8c5fc07f666379e313e63f683a"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_REFSPEC"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SYMLINK_CHECK_IGNORE_PATTERN"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_BASIC_AUTH_DIRECTORY",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SSH_DIRECTORY"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_OUTPUT_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBDIRECTORY",
                                    "value": "source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:fddbb4c2edb01a3f0065321f84cf2e4d8e483b4149e3d6f78dd0c46e85e35aef",
                            "name": "clone",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf \"$ca_bundle\" /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\nRESULT_FILE=\"$(mktemp)\"\nkonflux-build-cli git-clone \u003e\"${RESULT_FILE}\"\n\nprintf \"%s\" \"$(jq -r '.commit' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"$(jq -r '.shortCommit' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"$(jq -r '.url' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"$(jq -r '.commitTimestamp' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/commit-timestamp\"\nprintf \"%s\" \"$(jq -r '.\"CHAINS-GIT_URL\"' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(jq -r '.\"CHAINS-GIT_COMMIT\"' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\n\nMERGED_SHA=$(jq -r '.mergedSha // empty' \"${RESULT_FILE}\")\nif [ -n \"${MERGED_SHA}\" ]; then\n  printf \"%s\" \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "5d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/commit_sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wsynwn",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4/records/e5876f3e-7bfb-4834-ac3a-d5b08c533491",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-multi-component-child-suum"
                },
                "creationTimestamp": "2026-08-13T08:22:16Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:57Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-pull-request-b9456",
                    "tekton.dev/pipelineRunUID": "8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "f77ac87106ad2d9dbd1f2d442db15162ad8b430f08b29764a477fefe5fa8f9"
                },
                "name": "fj-multi-compo214fdfe6a34fca32e31a5c0a2a6a9f98-sast-shell-check",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-pull-request-b9456",
                        "uid": "8a58744a-92ae-4abd-9f78-08a68ab104e4"
                    }
                ],
                "resourceVersion": "29361",
                "uid": "e5876f3e-7bfb-4834-ac3a-d5b08c533491"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:b25a46b20e09eacec4e177cdd8d18a31fea38e9e346b49215e6e5044a00b8d85"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:23:01Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:23:01Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-compo214fdfe6a34fca67f1f91f4ba084cf48dbd9708bb2b25-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "b25a46b20e09eacec4e177cdd8d18a31fea38e9e346b49215e6e5044a00b8d85"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:22:58+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:22:16Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://415c9d35a5701b23a4c2e2dab0401f7959593f6b3a4e90ba9a8349aa40e87ce2",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://9ca5fc1e0efcb71d9a66c2c74548eb13d58c94971ec3307b4a58e1f5ad3ba286",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:58Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:58+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://da2377fec87890300ba034c9432dca528d156734d96028b9497a6a2f01cfd215",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:23:01Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:58+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:59Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip files containing Jinja2 template syntax ({{ }}, {% %}, {# #}). ShellCheck cannot parse Jinja2 constructs, so scanning such files produces unreliable findings.",
                            "name": "SKIP_JINJA",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SKIP_JINJA",
                                    "value": "true"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\nif [[ \"${SKIP_JINJA}\" == \"true\" ]]; then\n  export SC_SKIP_JINJA=1\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/commit_sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wsynwn",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4/records/e2e8349d-5d31-4465-95d3-a7fda4f38267",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-multi-component-child-suum"
                },
                "creationTimestamp": "2026-08-13T08:20:22Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:57Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-pull-request-b9456",
                    "tekton.dev/pipelineRunUID": "8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "f77ac87106ad2d9dbd1f2d442db15162ad8b430f08b29764a477fefe5fa8f9"
                },
                "name": "fj-multi-compon214fdfe6a34fca32e31a5c0a2a6a9f98-build-container",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-pull-request-b9456",
                        "uid": "8a58744a-92ae-4abd-9f78-08a68ab104e4"
                    }
                ],
                "resourceVersion": "29366",
                "uid": "e2e8349d-5d31-4465-95d3-a7fda4f38267"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "5d"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_DATE_EPOCH",
                        "value": ""
                    },
                    {
                        "name": "REWRITE_TIMESTAMP",
                        "value": "false"
                    },
                    {
                        "name": "OMIT_HISTORY",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.10.5@sha256:de644e1dee81463bd47e4e5a33688d4ef40cd963f0a17fccc9cf11ca92eea471"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:22:08Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:22:08Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-compon214fdfe6a34fdcb3fd680976013a1b789d88e60830d9-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "de644e1dee81463bd47e4e5a33688d4ef40cd963f0a17fccc9cf11ca92eea471"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:b8a265190127cf1bd46cf24244397b57434eed2ae618c7593b5bf06dabe507f4"
                    }
                ],
                "startTime": "2026-08-13T08:20:22Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://49982247144d7816f43c4c48e4ad636d628f303b04d837217ca22c34975eeb86",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:20:30Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:20:29Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://10e4900cf30054939e08d4f6f7f57ebfd4c04849623518b0bc5c5a041898ea86",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:20:41Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:20:30Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://03c5463028f98a2525cd5c42426655ec3d4a3c9bda50aebe1437d8cdb57a3b6a",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:21:11Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:20:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://c3eb190f773c155331e59727ff9daa45613f6fae1cb44e7a6fe351594a72de03",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:21:24Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:21:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://a4513407f4f7a1b7cfb694ac4ff55cbe7cfe9e541f862c6b63a16b303dbc945c",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:21:44Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:21:24Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://a5dc8b0dbdcdf7b21d4c090ed923f1b35dc999e4f4930240f562db0a848f9c02",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:07Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a@sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:b8a265190127cf1bd46cf24244397b57434eed2ae618c7593b5bf06dabe507f4\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:21:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Allows to use parent images that don't match the build host architecture. This option must be used with caution as it may create incompatible images.",
                            "name": "ALLOW_CROSS_PLATFORM_IMAGES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "info",
                            "description": "Log level for the build command.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "auto",
                            "description": "Mount /etc/rhsm/ca from the host machine into the build. Valid values are 'always', 'auto' (default), 'never'. Only effective if HERMETIC=false and ACTIVATION_KEY or ENTITLEMENT_SECRET is set.",
                            "name": "RHSM_MOUNT_CA_CERTS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ALLOW_CROSS_PLATFORM_IMAGES",
                                "value": "false"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "5d"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "KBC_LOG_LEVEL",
                                "value": "info"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "RHSM_MOUNT_CA_CERTS",
                                "value": "auto"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:58ff03692de7f77c8ad7195009ba9f15acce267cda92179d0a4ac260d8776ac2=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--envs",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "d704fe2e1a443a8c5fc07f666379e313e63f683a"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  echo \"[$(date --utc -Ins)] Update CA trust\"\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Delete policy settings for Red Hat registries to disable signature verification.\n# TODO: don't do this?\ncontainer_policy=$(\n  jq '.transports |= (\n        del(.docker.[\"registry.access.redhat.com\"]) |\n        del(.docker.[\"registry.redhat.io\"]) |\n        if (.docker == {}) then del(.docker) else . end\n      )' /etc/containers/policy.json\n)\necho \"Effective container policy:\"\nprintf '%s\\n' \"$container_policy\" | tee /etc/containers/policy.json\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\necho \"[$(date --utc -Ins)] Run the build\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  ANNOTATIONS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\")\nfi\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILD_ARGS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nsecurity_args=(--security-opts unmask=/proc/interrupts)\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  security_args+=(--security-opts label=disable)\n  security_args+=(--cap-add all)\n  security_args+=(--devices /dev/fuse)\nfi\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  security_args+=(--cap-add \"${ADD_CAPABILITIES}\")\nfi\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  prefetch_dir=\"/var/workdir/cachi2\"\n  # KBC defaults to ${prefetch_dir}/copy-*\n  # Copy to a sibling dir instead in case we don't have write permissions to the prefetch_dir.\n  # It's still on the same filesystem, so copying via reflinks should be possible.\n  prefetch_dir_copy=\"/var/workdir/prefetch-copy\"\nelse\n  prefetch_dir=\"\"\n  prefetch_dir_copy=\"\"\nfi\n\nyum_repos_d_sources=()\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  yum_repos_d_sources+=(\"${YUM_REPOS_D_FETCHED}\")\nfi\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  yum_repos_d_sources+=(\"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\")\nfi\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 4. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    to \"/etc/pki/entitlement\" to prevent certificates from being included\nrhsm_args=()\nif [ \"${HERMETIC}\" != \"true\" ]; then\n  if [ -e /activation-key/org ]; then\n    rhsm_args+=(--rhsm-activation-key=/activation-key/activationkey\n      --rhsm-org=/activation-key/org\n      --rhsm-activation-mount=/activation-key)\n\n    if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n      # user is not running registration in the Containerfile: pre-register.\n      rhsm_args+=(--rhsm-activation-preregister)\n    fi\n  elif find /entitlement -name \"*.pem\" \u003e/dev/null; then\n    rhsm_args+=(--rhsm-entitlements=/entitlement)\n  fi\nfi\nif [ \"${RHSM_MOUNT_CA_CERTS}\" != \"auto\" ]; then\n  rhsm_args+=(--rhsm-mount-ca-certs=\"$RHSM_MOUNT_CA_CERTS\")\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\ncmd=(\n  konflux-build-cli image build\n  -f \"$dockerfile_path\" -t \"$IMAGE\" --source \"$SOURCE_CODE_DIR\" --context \"$CONTEXT\"\n  --secret-dirs \"src=/additional-secret,name=$ADDITIONAL_SECRET,optional=true\"\n  --workdir-mount \"$WORKINGDIR_MOUNT\"\n  --target \"$TARGET_STAGE\"\n  --inherit-labels=\"$INHERIT_BASE_IMAGE_LABELS\"\n  --source-date-epoch \"$BUILDAH_SOURCE_DATE_EPOCH\"\n  --rewrite-timestamp=\"$BUILDAH_REWRITE_TIMESTAMP\"\n  --squash=\"$SQUASH\"\n  --omit-history=\"$BUILDAH_OMIT_HISTORY\"\n  --image-source \"$SOURCE_URL\"\n  --image-revision \"$COMMIT_SHA\"\n  --quay-image-expires-after \"$IMAGE_EXPIRES_AFTER\"\n  --build-args-file \"$BUILD_ARGS_FILE\"\n  --annotations-file \"$ANNOTATIONS_FILE\"\n  --legacy-build-timestamp \"$BUILD_TIMESTAMP\"\n  --add-legacy-labels\n  --include-legacy-buildinfo-path=\"$ICM_KEEP_COMPAT_LOCATION\"\n  --skip-injections=\"$SKIP_INJECTIONS\"\n  --skip-unused-stages=\"$SKIP_UNUSED_STAGES\"\n  --hermetic=\"$HERMETIC\"\n  --image-pull-proxy \"$BUILDAH_HTTP_PROXY\"\n  --image-pull-noproxy \"$BUILDAH_NO_PROXY\"\n  --yum-repos-d-sources \"${yum_repos_d_sources[@]}\"\n  --yum-repos-d-target \"$YUM_REPOS_D_TARGET\"\n  --prefetch-dir \"$prefetch_dir\"\n  --prefetch-dir-copy \"$prefetch_dir_copy\"\n  --prefetch-env-mount /cachi2/cachi2.env\n  --prefetch-output-mount /cachi2/output\n  \"${security_args[@]}\"\n  \"${rhsm_args[@]}\"\n  --containerfile-json-output /shared/parsed_dockerfile.json\n  --resolved-base-images-output /shared/base_images_digests\n  --no-cache\n  --ulimits nofile=4096:4096\n  --src-tls-verify=\"$TLSVERIFY\"\n  --dest-tls-verify=\"$TLSVERIFY\"\n  --allow-cross-platform-images=\"$ALLOW_CROSS_PLATFORM_IMAGES\"\n  \"$@\" # --annotations, --labels, --envs, --build-args\n)\n\necho \"[$(date --utc -Ins)] $(printf '%q ' \"${cmd[@]}\")\"\n\n\"${cmd[@]}\"\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"${prefetch_dir}/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp \"${prefetch_dir}/output/bom.json\" ./sbom-prefetch.json\nfi\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "fj-multi-compon214fdfe6a34fca32e31a5c0a2a6a9f98-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee \"/tekton/results/IMAGE_URL\"\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.1-1782136886@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/commit_sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wsynwn",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4/records/c520832a-da10-4956-9e99-0db37e89188f",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-multi-component-child-suum"
                },
                "creationTimestamp": "2026-08-13T08:22:16Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:57Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-pull-request-b9456",
                    "tekton.dev/pipelineRunUID": "8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min",
                    "test.appstudio.openshift.io/pr-group-sha": "f77ac87106ad2d9dbd1f2d442db15162ad8b430f08b29764a477fefe5fa8f9"
                },
                "name": "fj-multi-component-child-suum-on-pull-request-b9456-clamav-scan",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-pull-request-b9456",
                        "uid": "8a58744a-92ae-4abd-9f78-08a68ab104e4"
                    }
                ],
                "resourceVersion": "29365",
                "uid": "c520832a-da10-4956-9e99-0db37e89188f"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:9f7f5ca49400455e48ab2a1cce4759c7aab43c9a09e2a81714c8039efea5c811"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:23:06Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:23:06Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-sud0229b2a7d1a0956b75b22afb740ec68-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f7f5ca49400455e48ab2a1cce4759c7aab43c9a09e2a81714c8039efea5c811"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\", \"digests\": [\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1786609382\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "startTime": "2026-08-13T08:22:16Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:dbe5e223cf38ee7d6ab01cafa1593605f31f6a204fad0afd9ffe5ac8650222d5",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://4a1bf0417e54e33a572201607c02b33a500acea456ce5f6e36f250f6738f8923",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:23:02Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\\\", \\\"digests\\\": [\\\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786609382\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:24Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://04314c6a47f7990b68a764f817dbfd351ae009e77bdcfb1fb72fa88146d508dd",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:23:05Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\\\", \\\"digests\\\": [\\\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786609382\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:23:02Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=\"content-${arch}\"\n    mkdir -p \"$destination\"\n    arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:2.1.0@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/commit_sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wsynwn",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4/records/d1926559-498e-4d13-80ef-6b1fd966be00",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-multi-component-child-suum"
                },
                "creationTimestamp": "2026-08-13T08:18:57Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:57Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-pull-request-b9456",
                    "tekton.dev/pipelineRunUID": "8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "f77ac87106ad2d9dbd1f2d442db15162ad8b430f08b29764a477fefe5fa8f9"
                },
                "name": "fj-multi-component-child-suum-on-pull-request-b9456-init",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-pull-request-b9456",
                        "uid": "8a58744a-92ae-4abd-9f78-08a68ab104e4"
                    }
                ],
                "resourceVersion": "29358",
                "uid": "d1926559-498e-4d13-80ef-6b1fd966be00"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:19:24Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:19:24Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-suum-on-pull-request-b9456-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "startTime": "2026-08-13T08:18:57Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5d0bc162f7fdfc7c5bb62dd9ce2193bb5214c99dce90ccb818efb39bad045a37",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:19:19Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:19:19Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/commit_sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-wsynwn",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-multi-component-child-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4/records/8cb1dd0b-8990-4152-a4b0-6487b1d610e2",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"d704fe2e1a443a8c5fc07f666379e313e63f683a\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-multi-component-child-suum"
                },
                "creationTimestamp": "2026-08-13T08:22:16Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:57Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "d704fe2e1a443a8c5fc07f666379e313e63f683a",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-pull-request-b9456",
                    "tekton.dev/pipelineRunUID": "8a58744a-92ae-4abd-9f78-08a68ab104e4",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "f77ac87106ad2d9dbd1f2d442db15162ad8b430f08b29764a477fefe5fa8f9"
                },
                "name": "fj-multi-component-child-suum-on-pull-request-b9456-tpa-scan",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-pull-request-b9456",
                        "uid": "8a58744a-92ae-4abd-9f78-08a68ab104e4"
                    }
                ],
                "resourceVersion": "29354",
                "uid": "8cb1dd0b-8990-4152-a4b0-6487b1d610e2"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:6a204cecc1a1091bf928b3db5a4082735c2111f90befdb5b043c498833c02bcf"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:22:46Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:22:46Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-su8f0b6b0c45b85a96738bbb4ac032f48b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "6a204cecc1a1091bf928b3db5a4082735c2111f90befdb5b043c498833c02bcf"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\", \"digests\": [\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\":\"sha256:924a79dcb5a416df3e0792efb97437b6d0f50013fc4e168520a8f2d341b8ab1a\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:22:45+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:22:18Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://24e98e68c0636a9b94a557ef4a09d970cf9d20ac94538a03a8c02563016c0313",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:41Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://0e129c66d628b51d428096d4d975173c0a4b7adeac562269f739ef7fc7252c8f",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:44Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:41Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://9aa8a50c00c58b8c762d2403871dbf8c26f7aa18491196ee5e9ee0d0ecad7104",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:45Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a\\\", \\\"digests\\\": [\\\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6\\\":\\\"sha256:924a79dcb5a416df3e0792efb97437b6d0f50013fc4e168520a8f2d341b8ab1a\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:45+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:44Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:cce103ba7abd19bc1343e04249c76ab69cf44ed18a216e0fa5156f3894e881d6"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:on-pr-d704fe2e1a443a8c5fc07f666379e313e63f683a"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:2.1.0@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/commit_sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-chgcms",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'updated to build repo image' (#2) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87/records/1558debf-53f6-405c-8017-114a493fc084",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux"
                },
                "creationTimestamp": "2026-08-13T08:25:31Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-rqwtf",
                    "tekton.dev/pipelineRunUID": "a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min"
                },
                "name": "fj-multi-component-child-suum-on-push-rqwtf-build-container",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-rqwtf",
                        "uid": "a5c45622-3b94-4222-aa59-e9e38de19b87"
                    }
                ],
                "resourceVersion": "29318",
                "uid": "1558debf-53f6-405c-8017-114a493fc084"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_DATE_EPOCH",
                        "value": ""
                    },
                    {
                        "name": "REWRITE_TIMESTAMP",
                        "value": "false"
                    },
                    {
                        "name": "OMIT_HISTORY",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.10.5@sha256:de644e1dee81463bd47e4e5a33688d4ef40cd963f0a17fccc9cf11ca92eea471"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:16Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:16Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-suum-on-push-rqwtf-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "de644e1dee81463bd47e4e5a33688d4ef40cd963f0a17fccc9cf11ca92eea471"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9e8d4f0a883c78807f7238ede281c4cba6c79dce9fe57ec7254571ce210b3207"
                    }
                ],
                "startTime": "2026-08-13T08:25:31Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://74ced43d3b2b8da1a972a743d257ec62ade04c0a1128ce2a81aca0f61c38aaea",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:38Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:37Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://f113fbf6aab572c8e38ea18b057bd6d0d78725b649296dc7f46060371722b4aa",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:38Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://d84a45da04fe482c2fd8244b21a79c9d9ba6e24b2b089b619c7c097d38b14851",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:26:19Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://265acf6d405da9de1a948fe8dba850f030eb5792af1f0eac64f874c6fbb76f59",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:26:31Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:26:19Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://7f9fe92138cb950a4f7ad4c43b58213b51fa1c1b2b7d9bc143848a67cba9799d",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:26:52Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:26:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://890c64a794a73a4d54344aab029401d7461ebc13fa95b63dcf4948958baccac9",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:15Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9e8d4f0a883c78807f7238ede281c4cba6c79dce9fe57ec7254571ce210b3207\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:26:53Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Allows to use parent images that don't match the build host architecture. This option must be used with caution as it may create incompatible images.",
                            "name": "ALLOW_CROSS_PLATFORM_IMAGES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "info",
                            "description": "Log level for the build command.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "auto",
                            "description": "Mount /etc/rhsm/ca from the host machine into the build. Valid values are 'always', 'auto' (default), 'never'. Only effective if HERMETIC=false and ACTIVATION_KEY or ENTITLEMENT_SECRET is set.",
                            "name": "RHSM_MOUNT_CA_CERTS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ALLOW_CROSS_PLATFORM_IMAGES",
                                "value": "false"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "KBC_LOG_LEVEL",
                                "value": "info"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "RHSM_MOUNT_CA_CERTS",
                                "value": "auto"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--envs",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "f4af709d37a72dc297c418b1d673e2eeb02595f8"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  echo \"[$(date --utc -Ins)] Update CA trust\"\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Delete policy settings for Red Hat registries to disable signature verification.\n# TODO: don't do this?\ncontainer_policy=$(\n  jq '.transports |= (\n        del(.docker.[\"registry.access.redhat.com\"]) |\n        del(.docker.[\"registry.redhat.io\"]) |\n        if (.docker == {}) then del(.docker) else . end\n      )' /etc/containers/policy.json\n)\necho \"Effective container policy:\"\nprintf '%s\\n' \"$container_policy\" | tee /etc/containers/policy.json\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\necho \"[$(date --utc -Ins)] Run the build\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  ANNOTATIONS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\")\nfi\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILD_ARGS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nsecurity_args=(--security-opts unmask=/proc/interrupts)\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  security_args+=(--security-opts label=disable)\n  security_args+=(--cap-add all)\n  security_args+=(--devices /dev/fuse)\nfi\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  security_args+=(--cap-add \"${ADD_CAPABILITIES}\")\nfi\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  prefetch_dir=\"/var/workdir/cachi2\"\n  # KBC defaults to ${prefetch_dir}/copy-*\n  # Copy to a sibling dir instead in case we don't have write permissions to the prefetch_dir.\n  # It's still on the same filesystem, so copying via reflinks should be possible.\n  prefetch_dir_copy=\"/var/workdir/prefetch-copy\"\nelse\n  prefetch_dir=\"\"\n  prefetch_dir_copy=\"\"\nfi\n\nyum_repos_d_sources=()\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  yum_repos_d_sources+=(\"${YUM_REPOS_D_FETCHED}\")\nfi\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  yum_repos_d_sources+=(\"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\")\nfi\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 4. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    to \"/etc/pki/entitlement\" to prevent certificates from being included\nrhsm_args=()\nif [ \"${HERMETIC}\" != \"true\" ]; then\n  if [ -e /activation-key/org ]; then\n    rhsm_args+=(--rhsm-activation-key=/activation-key/activationkey\n      --rhsm-org=/activation-key/org\n      --rhsm-activation-mount=/activation-key)\n\n    if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n      # user is not running registration in the Containerfile: pre-register.\n      rhsm_args+=(--rhsm-activation-preregister)\n    fi\n  elif find /entitlement -name \"*.pem\" \u003e/dev/null; then\n    rhsm_args+=(--rhsm-entitlements=/entitlement)\n  fi\nfi\nif [ \"${RHSM_MOUNT_CA_CERTS}\" != \"auto\" ]; then\n  rhsm_args+=(--rhsm-mount-ca-certs=\"$RHSM_MOUNT_CA_CERTS\")\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\ncmd=(\n  konflux-build-cli image build\n  -f \"$dockerfile_path\" -t \"$IMAGE\" --source \"$SOURCE_CODE_DIR\" --context \"$CONTEXT\"\n  --secret-dirs \"src=/additional-secret,name=$ADDITIONAL_SECRET,optional=true\"\n  --workdir-mount \"$WORKINGDIR_MOUNT\"\n  --target \"$TARGET_STAGE\"\n  --inherit-labels=\"$INHERIT_BASE_IMAGE_LABELS\"\n  --source-date-epoch \"$BUILDAH_SOURCE_DATE_EPOCH\"\n  --rewrite-timestamp=\"$BUILDAH_REWRITE_TIMESTAMP\"\n  --squash=\"$SQUASH\"\n  --omit-history=\"$BUILDAH_OMIT_HISTORY\"\n  --image-source \"$SOURCE_URL\"\n  --image-revision \"$COMMIT_SHA\"\n  --quay-image-expires-after \"$IMAGE_EXPIRES_AFTER\"\n  --build-args-file \"$BUILD_ARGS_FILE\"\n  --annotations-file \"$ANNOTATIONS_FILE\"\n  --legacy-build-timestamp \"$BUILD_TIMESTAMP\"\n  --add-legacy-labels\n  --include-legacy-buildinfo-path=\"$ICM_KEEP_COMPAT_LOCATION\"\n  --skip-injections=\"$SKIP_INJECTIONS\"\n  --skip-unused-stages=\"$SKIP_UNUSED_STAGES\"\n  --hermetic=\"$HERMETIC\"\n  --image-pull-proxy \"$BUILDAH_HTTP_PROXY\"\n  --image-pull-noproxy \"$BUILDAH_NO_PROXY\"\n  --yum-repos-d-sources \"${yum_repos_d_sources[@]}\"\n  --yum-repos-d-target \"$YUM_REPOS_D_TARGET\"\n  --prefetch-dir \"$prefetch_dir\"\n  --prefetch-dir-copy \"$prefetch_dir_copy\"\n  --prefetch-env-mount /cachi2/cachi2.env\n  --prefetch-output-mount /cachi2/output\n  \"${security_args[@]}\"\n  \"${rhsm_args[@]}\"\n  --containerfile-json-output /shared/parsed_dockerfile.json\n  --resolved-base-images-output /shared/base_images_digests\n  --no-cache\n  --ulimits nofile=4096:4096\n  --src-tls-verify=\"$TLSVERIFY\"\n  --dest-tls-verify=\"$TLSVERIFY\"\n  --allow-cross-platform-images=\"$ALLOW_CROSS_PLATFORM_IMAGES\"\n  \"$@\" # --annotations, --labels, --envs, --build-args\n)\n\necho \"[$(date --utc -Ins)] $(printf '%q ' \"${cmd[@]}\")\"\n\n\"${cmd[@]}\"\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"${prefetch_dir}/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp \"${prefetch_dir}/output/bom.json\" ./sbom-prefetch.json\nfi\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "fj-multi-component-child-suum-on-push-rqwtf-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee \"/tekton/results/IMAGE_URL\"\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.1-1782136886@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/commit_sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-chgcms",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'updated to build repo image' (#2) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87/records/28599ff3-d5cb-4034-b8c1-1e57f87b9427",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:16Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-rqwtf",
                    "tekton.dev/pipelineRunUID": "a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min"
                },
                "name": "fj-multi-component-child-suum-on-push-rqwtf-build-image-index",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-rqwtf",
                        "uid": "a5c45622-3b94-4222-aa59-e9e38de19b87"
                    }
                ],
                "resourceVersion": "29313",
                "uid": "28599ff3-d5cb-4034-b8c1-1e57f87b9427"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3.1@sha256:70679b88f57130e9a939a6765aacd976a9d66bfa5d1733fcee185dc07be39042"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:25Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:25Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-su326d5f8aa74734f5781092866bf2199c-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "70679b88f57130e9a939a6765aacd976a9d66bfa5d1733fcee185dc07be39042"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    }
                ],
                "startTime": "2026-08-13T08:27:16Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://1d92894350f92c87debfc81f8587e29b98846ef0369627dc470508ebca7490b4",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:22Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:20Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://f998d5a96a3d5bdf3873e2ea127d5ea88b0aefa8a390fac6c816e6af3e903eeb",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:22Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:22Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://afdf50d6c90c1b6006c655bd428663a09c1dfe6880306290e79772e15b2c886a",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:24Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:22Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "false"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8@sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"fj-multi-component-child-suum-on-push-rqwtf-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.1-1782136886@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/commit_sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-chgcms",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'updated to build repo image' (#2) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87/records/ea2bbcf0-6289-4e12-ad8f-278cbef40540",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:25Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-rqwtf",
                    "tekton.dev/pipelineRunUID": "a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min"
                },
                "name": "fj-multi-component-child-suum-on-push-rqwtf-clamav-scan",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-rqwtf",
                        "uid": "a5c45622-3b94-4222-aa59-e9e38de19b87"
                    }
                ],
                "resourceVersion": "29307",
                "uid": "ea2bbcf0-6289-4e12-ad8f-278cbef40540"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:9f7f5ca49400455e48ab2a1cce4759c7aab43c9a09e2a81714c8039efea5c811"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:28:15Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:28:15Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-suum-on-push-rqwtf-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f7f5ca49400455e48ab2a1cce4759c7aab43c9a09e2a81714c8039efea5c811"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\", \"digests\": [\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1786609690\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:25Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:dbe5e223cf38ee7d6ab01cafa1593605f31f6a204fad0afd9ffe5ac8650222d5",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://b87a6831726aed75f020c410c7930fcf089b4c23efd539641cac1c3ad4f052bb",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:28:10Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\\\", \\\"digests\\\": [\\\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786609690\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:32Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://71fe251f45cc0e2121a6d524f626de659678130a9e24f22ea67e3e2e064201e1",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:28:14Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\\\", \\\"digests\\\": [\\\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786609690\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:28:11Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=\"content-${arch}\"\n    mkdir -p \"$destination\"\n    arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:2.1.0@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/commit_sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-chgcms",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'updated to build repo image' (#2) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87/records/526b7cc6-f398-4d4e-a424-6030561fd67c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git"
                },
                "creationTimestamp": "2026-08-13T08:24:45Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-rqwtf",
                    "tekton.dev/pipelineRunUID": "a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min"
                },
                "name": "fj-multi-component-child-suum-on-push-rqwtf-clone-repository",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-rqwtf",
                        "uid": "a5c45622-3b94-4222-aa59-e9e38de19b87"
                    }
                ],
                "resourceVersion": "29321",
                "uid": "526b7cc6-f398-4d4e-a424-6030561fd67c"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                    },
                    {
                        "name": "revision",
                        "value": "f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.2.4@sha256:f90deac0d63b43c7cb3f0b2d83ee56aa7fa18bb493f084286c6a953bbf479d8d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-chgcms"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:24:55Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:24:55Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-su55fc339ac635198e7aceb0005b832168-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "f90deac0d63b43c7cb3f0b2d83ee56aa7fa18bb493f084286c6a953bbf479d8d"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1786609460"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "f4af709"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd"
                    }
                ],
                "startTime": "2026-08-13T08:24:45Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:fddbb4c2edb01a3f0065321f84cf2e4d8e483b4149e3d6f78dd0c46e85e35aef",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://3eb98247c4e8b56938868e55af5b2b24810fdd6316e511a50ec2049ed51321cc",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:24:53Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-child-jybppk\",\"type\":1},{\"key\":\"commit\",\"value\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1786609460\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"f4af709\",\"type\":1},{\"key\":\"url\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-child-jybppk\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:24:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://ebd9b605c20200fce7bedfc187570bef5f72335ff68eff874f9b03dd5e2b2a4e",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:24:55Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-child-jybppk\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd\",\"type\":1},{\"key\":\"commit\",\"value\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1786609460\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"f4af709\",\"type\":1},{\"key\":\"url\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-child-jybppk\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:24:53Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level for the git-clone command.",
                            "name": "logLevel",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Minimum length of the short commit SHA. Git may return a longer prefix if needed for uniqueness.",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched. Empty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "CSV list of path patterns to exclude from the symlink check. Symlinks whose paths match\nare not checked. Patterns are relative to the checkout directory and must not start with '/'.\nUse '*' and '?' as wildcards ('*' matches across '/').\nQuote patterns containing commas using CSV double quotes.\n",
                            "name": "symlinkCheckIgnorePattern",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "Abbreviated commit SHA for the checkout. At least params.shortCommitLength characters; longer if Git requires more for uniqueness.",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_GIT_CLONE_URL",
                                    "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_REVISION",
                                    "value": "f4af709d37a72dc297c418b1d673e2eeb02595f8"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_REFSPEC"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SYMLINK_CHECK_IGNORE_PATTERN"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_BASIC_AUTH_DIRECTORY",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SSH_DIRECTORY"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_OUTPUT_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBDIRECTORY",
                                    "value": "source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:fddbb4c2edb01a3f0065321f84cf2e4d8e483b4149e3d6f78dd0c46e85e35aef",
                            "name": "clone",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf \"$ca_bundle\" /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\nRESULT_FILE=\"$(mktemp)\"\nkonflux-build-cli git-clone \u003e\"${RESULT_FILE}\"\n\nprintf \"%s\" \"$(jq -r '.commit' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"$(jq -r '.shortCommit' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"$(jq -r '.url' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"$(jq -r '.commitTimestamp' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/commit-timestamp\"\nprintf \"%s\" \"$(jq -r '.\"CHAINS-GIT_URL\"' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(jq -r '.\"CHAINS-GIT_COMMIT\"' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\n\nMERGED_SHA=$(jq -r '.mergedSha // empty' \"${RESULT_FILE}\")\nif [ -n \"${MERGED_SHA}\" ]; then\n  printf \"%s\" \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/commit_sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-chgcms",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'updated to build repo image' (#2) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87/records/e913cd49-908b-48c8-8ba4-1275cb53561b",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:24:39Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-rqwtf",
                    "tekton.dev/pipelineRunUID": "a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init"
                },
                "name": "fj-multi-component-child-suum-on-push-rqwtf-init",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-rqwtf",
                        "uid": "a5c45622-3b94-4222-aa59-e9e38de19b87"
                    }
                ],
                "resourceVersion": "29300",
                "uid": "e913cd49-908b-48c8-8ba4-1275cb53561b"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:24:42Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:24:42Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-suum-on-push-rqwtf-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "startTime": "2026-08-13T08:24:39Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://4b59e8e119275b06421ec4ec31c62b176f837babef0c46b029b3f49d0c20cbcf",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:24:41Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:24:41Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/commit_sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-chgcms",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'updated to build repo image' (#2) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87/records/8c7523b6-b990-4ef2-a32d-98aaa5151628",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "results.tekton.dev/stored": "true"
                },
                "creationTimestamp": "2026-08-13T08:27:25Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-rqwtf",
                    "tekton.dev/pipelineRunUID": "a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan"
                },
                "name": "fj-multi-component-child-suum-on-push-rqwtf-rpms-signature-scan",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-rqwtf",
                        "uid": "a5c45622-3b94-4222-aa59-e9e38de19b87"
                    }
                ],
                "resourceVersion": "29308",
                "uid": "8c7523b6-b990-4ef2-a32d-98aaa5151628"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:ccb77d1bf7627fc6241a59ed42bb6e5707a8682754fe8ae18f2cfdddbcf29275"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:43Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:43Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-sua46ecb1160b29ab929bd1a5cf0a9e567-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ccb77d1bf7627fc6241a59ed42bb6e5707a8682754fe8ae18f2cfdddbcf29275"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\", \"digests\": [\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:27:42+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:26Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:816a2ad35037f3233903278371f766102735f96cfaf48a9663ce5b858cec34b3",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://6468002f3cd3a448db35e9ebde2cc9b1d8be1e8e1754ff3ed56c7094886e5683",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:41Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5a406f419e96a37ab4433abd60f1cf85c656588f8da9c9e02bad3c453fe93533",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:42Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\\\", \\\"digests\\\": [\\\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:42+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:42Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:816a2ad35037f3233903278371f766102735f96cfaf48a9663ce5b858cec34b3",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/commit_sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-chgcms",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'updated to build repo image' (#2) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87/records/a4ca5c48-0646-4e3f-9f49-c1491d11a471",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:25Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-rqwtf",
                    "tekton.dev/pipelineRunUID": "a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min"
                },
                "name": "fj-multi-component-child-suum-on-push-rqwtf-sast-shell-check",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-rqwtf",
                        "uid": "a5c45622-3b94-4222-aa59-e9e38de19b87"
                    }
                ],
                "resourceVersion": "29317",
                "uid": "a4ca5c48-0646-4e3f-9f49-c1491d11a471"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:b25a46b20e09eacec4e177cdd8d18a31fea38e9e346b49215e6e5044a00b8d85"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:46Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:46Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-sud668d0673f3c61161d58bf8fdf678e61-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "b25a46b20e09eacec4e177cdd8d18a31fea38e9e346b49215e6e5044a00b8d85"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:27:43+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:25Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://2bd9e0c5185a9a9ebe602f6ad6d41266693df767681094bb5a3a41205ad9b40d",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:34Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://dd6b299b7da5a7cbffdf9e29b76b3544c1af9dcfe6e97d406c10b150827558cd",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:43Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:43+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://4daad9111a35367646d22a0c236046fa370aeb5be65ca322c260fcbc5e207282",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:45Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:43+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:43Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip files containing Jinja2 template syntax ({{ }}, {% %}, {# #}). ShellCheck cannot parse Jinja2 constructs, so scanning such files produces unreliable findings.",
                            "name": "SKIP_JINJA",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SKIP_JINJA",
                                    "value": "true"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\nif [[ \"${SKIP_JINJA}\" == \"true\" ]]; then\n  export SC_SKIP_JINJA=1\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/commit_sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-chgcms",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'updated to build repo image' (#2) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87/records/7c12ebbd-d998-4d64-9a70-b9f58c9f2ab7",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:25Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-rqwtf",
                    "tekton.dev/pipelineRunUID": "a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min"
                },
                "name": "fj-multi-component-child-suum-on-push-rqwtf-sast-unicode-check",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-rqwtf",
                        "uid": "a5c45622-3b94-4222-aa59-e9e38de19b87"
                    }
                ],
                "resourceVersion": "29303",
                "uid": "7c12ebbd-d998-4d64-9a70-b9f58c9f2ab7"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:80bf85aebf99a9d26c2d3fae3d90ee6bfe28246e3b0bbd950934ceba764bc067"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:39Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:39Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-suea4a2cf121b74d3b5a805afa68745d76-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "80bf85aebf99a9d26c2d3fae3d90ee6bfe28246e3b0bbd950934ceba764bc067"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:27:36+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:25Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://d49cb77dfd44ddf8aaebe2a0056c119ebea44add7186b87b4bba8b80d3f3fd5d",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:34Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://309b8f0e20bb134c37f15d066cc441610b426e148aaa0162c1d95c68470b9279",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:36Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:36+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://7dbc99b3a0dac6b8467c2fd1ce9b0d6cdbff92a1aad535ac400b0dc0c1acc39b",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:38Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:36+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:37Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:46498db2b0e7c7d9d4277d4f8f1d92fd2d2f7efefa3ac6dbbcaea0c7cb7adfdd=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/commit_sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-chgcms",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'updated to build repo image' (#2) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87/records/7d8f6ceb-3f26-476f-a761-b3b83df732c3",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"f4af709d37a72dc297c418b1d673e2eeb02595f8\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:25Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:56Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "f4af709d37a72dc297c418b1d673e2eeb02595f8",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-rqwtf",
                    "tekton.dev/pipelineRunUID": "a5c45622-3b94-4222-aa59-e9e38de19b87",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan"
                },
                "name": "fj-multi-component-child-suum-on-push-rqwtf-tpa-scan",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-rqwtf",
                        "uid": "a5c45622-3b94-4222-aa59-e9e38de19b87"
                    }
                ],
                "resourceVersion": "29310",
                "uid": "7d8f6ceb-3f26-476f-a761-b3b83df732c3"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:6a204cecc1a1091bf928b3db5a4082735c2111f90befdb5b043c498833c02bcf"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:46Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:46Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-suum-on-push-rqwtf-tpa-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "6a204cecc1a1091bf928b3db5a4082735c2111f90befdb5b043c498833c02bcf"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\", \"digests\": [\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\":\"sha256:ad4868f3e27eccc0ea8922c57b86c9781a942671623d013eee8c9c682e364453\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:27:44+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:26Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5f61a7227dbf71732dd7ef75626220774af3f7ba42762ccb86164c7a543dab29",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:39Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://0dd44af0f3d1f7827117b334a52291c85fa3cd821b72e46e298a488e45238a7e",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:42Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:39Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://2fd9f50309466bcb5b796c68468d287ecb260fa82fdb8616f2ce481c8f707c35",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:44Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8\\\", \\\"digests\\\": [\\\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7\\\":\\\"sha256:ad4868f3e27eccc0ea8922c57b86c9781a942671623d013eee8c9c682e364453\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:44+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:43Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:850b2fc4b1b5ff3ab09931cefc0e26095bc4108d1f984ed885830ceeea7ddca7"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:f4af709d37a72dc297c418b1d673e2eeb02595f8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:2.1.0@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/7336352f02531bc71db4b3c14ad0459a556e2d49",
                    "build.appstudio.redhat.com/commit_sha": "7336352f02531bc71db4b3c14ad0459a556e2d49",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-cosvkf",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "7336352f02531bc71db4b3c14ad0459a556e2d49",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Update fj-multi-component-parent-suum to 82b98e4' (#3) from konflux/component-updates/fj-multi-component-child-suum-component-update-fj-multi-component-parent-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/7336352f02531bc71db4b3c14ad0459a556e2d49",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/0ac4e715-293f-49e0-bec5-efc9567708bc/records/a5dcda25-d229-4098-ae80-400fa0c646a4",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"7336352f02531bc71db4b3c14ad0459a556e2d49\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/0ac4e715-293f-49e0-bec5-efc9567708bc",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:31:34Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:47Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "7336352f02531bc71db4b3c14ad0459a556e2d49",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-smvzh",
                    "tekton.dev/pipelineRunUID": "0ac4e715-293f-49e0-bec5-efc9567708bc",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init"
                },
                "name": "fj-multi-component-child-suum-on-push-smvzh-init",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-smvzh",
                        "uid": "0ac4e715-293f-49e0-bec5-efc9567708bc"
                    }
                ],
                "resourceVersion": "29141",
                "uid": "a5dcda25-d229-4098-ae80-400fa0c646a4"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:31:38Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:31:38Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-suum-on-push-smvzh-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "startTime": "2026-08-13T08:31:35Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://11f400086852a36a72110942c673802e0d26816600b28cf7f88558926e0abd2e",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:31:38Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:31:38Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/commit_sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xyhwgy",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-child-suum' (#1) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42/records/1f65693b-36b0-4b9c-85c9-19a838f511f3",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux"
                },
                "creationTimestamp": "2026-08-13T08:25:07Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:32:00Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-x6hbt",
                    "tekton.dev/pipelineRunUID": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min"
                },
                "name": "fj-multi-component-child-suum-on-push-x6hbt-build-container",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-x6hbt",
                        "uid": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42"
                    }
                ],
                "resourceVersion": "29425",
                "uid": "1f65693b-36b0-4b9c-85c9-19a838f511f3"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "617d2045b023b9c3874784751384ee4f2df6f1d3"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_DATE_EPOCH",
                        "value": ""
                    },
                    {
                        "name": "REWRITE_TIMESTAMP",
                        "value": "false"
                    },
                    {
                        "name": "OMIT_HISTORY",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.10.5@sha256:de644e1dee81463bd47e4e5a33688d4ef40cd963f0a17fccc9cf11ca92eea471"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:26:54Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:26:54Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-suum-on-push-x6hbt-build-container-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "de644e1dee81463bd47e4e5a33688d4ef40cd963f0a17fccc9cf11ca92eea471"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:d2d966103b2bb87d44ff1ef60fc02a9e7c16f1189b642423fe2cbbbb27ba00d8"
                    }
                ],
                "startTime": "2026-08-13T08:25:07Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://f89963ce578eb16ce2fa72adf0172e0471100a0552147d44600d410fa11123b6",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:14Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://71e8f252fd3a988ea0e3f8e221f23791e55ec01e57e8252cdb8ce34dd67ab018",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:26Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:14Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://1f99fc0bbc37d741543e05da09e43a869ed0c3d9c07230eccaf88c1f5c82ed3f",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:55Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:26Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://516a9988b4d26b20a3bdb970304def10269e530288f3d7a129751f5ad45ac752",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:26:08Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:56Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://77a10a282eb045984af13aef80a45065b1e80737a470be4ba51032ba300776c5",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:26:29Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:26:09Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://fc00098cd00502c1f4505fa03450c8f95b250bd76b1cfb39558aabf411c18be0",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:26:53Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:d2d966103b2bb87d44ff1ef60fc02a9e7c16f1189b642423fe2cbbbb27ba00d8\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:26:30Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Allows to use parent images that don't match the build host architecture. This option must be used with caution as it may create incompatible images.",
                            "name": "ALLOW_CROSS_PLATFORM_IMAGES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "info",
                            "description": "Log level for the build command.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "auto",
                            "description": "Mount /etc/rhsm/ca from the host machine into the build. Valid values are 'always', 'auto' (default), 'never'. Only effective if HERMETIC=false and ACTIVATION_KEY or ENTITLEMENT_SECRET is set.",
                            "name": "RHSM_MOUNT_CA_CERTS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ALLOW_CROSS_PLATFORM_IMAGES",
                                "value": "false"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "KBC_LOG_LEVEL",
                                "value": "info"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "RHSM_MOUNT_CA_CERTS",
                                "value": "auto"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--envs",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "617d2045b023b9c3874784751384ee4f2df6f1d3"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  echo \"[$(date --utc -Ins)] Update CA trust\"\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Delete policy settings for Red Hat registries to disable signature verification.\n# TODO: don't do this?\ncontainer_policy=$(\n  jq '.transports |= (\n        del(.docker.[\"registry.access.redhat.com\"]) |\n        del(.docker.[\"registry.redhat.io\"]) |\n        if (.docker == {}) then del(.docker) else . end\n      )' /etc/containers/policy.json\n)\necho \"Effective container policy:\"\nprintf '%s\\n' \"$container_policy\" | tee /etc/containers/policy.json\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\necho \"[$(date --utc -Ins)] Run the build\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  ANNOTATIONS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\")\nfi\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILD_ARGS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nsecurity_args=(--security-opts unmask=/proc/interrupts)\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  security_args+=(--security-opts label=disable)\n  security_args+=(--cap-add all)\n  security_args+=(--devices /dev/fuse)\nfi\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  security_args+=(--cap-add \"${ADD_CAPABILITIES}\")\nfi\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  prefetch_dir=\"/var/workdir/cachi2\"\n  # KBC defaults to ${prefetch_dir}/copy-*\n  # Copy to a sibling dir instead in case we don't have write permissions to the prefetch_dir.\n  # It's still on the same filesystem, so copying via reflinks should be possible.\n  prefetch_dir_copy=\"/var/workdir/prefetch-copy\"\nelse\n  prefetch_dir=\"\"\n  prefetch_dir_copy=\"\"\nfi\n\nyum_repos_d_sources=()\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  yum_repos_d_sources+=(\"${YUM_REPOS_D_FETCHED}\")\nfi\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  yum_repos_d_sources+=(\"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\")\nfi\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 4. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    to \"/etc/pki/entitlement\" to prevent certificates from being included\nrhsm_args=()\nif [ \"${HERMETIC}\" != \"true\" ]; then\n  if [ -e /activation-key/org ]; then\n    rhsm_args+=(--rhsm-activation-key=/activation-key/activationkey\n      --rhsm-org=/activation-key/org\n      --rhsm-activation-mount=/activation-key)\n\n    if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n      # user is not running registration in the Containerfile: pre-register.\n      rhsm_args+=(--rhsm-activation-preregister)\n    fi\n  elif find /entitlement -name \"*.pem\" \u003e/dev/null; then\n    rhsm_args+=(--rhsm-entitlements=/entitlement)\n  fi\nfi\nif [ \"${RHSM_MOUNT_CA_CERTS}\" != \"auto\" ]; then\n  rhsm_args+=(--rhsm-mount-ca-certs=\"$RHSM_MOUNT_CA_CERTS\")\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\ncmd=(\n  konflux-build-cli image build\n  -f \"$dockerfile_path\" -t \"$IMAGE\" --source \"$SOURCE_CODE_DIR\" --context \"$CONTEXT\"\n  --secret-dirs \"src=/additional-secret,name=$ADDITIONAL_SECRET,optional=true\"\n  --workdir-mount \"$WORKINGDIR_MOUNT\"\n  --target \"$TARGET_STAGE\"\n  --inherit-labels=\"$INHERIT_BASE_IMAGE_LABELS\"\n  --source-date-epoch \"$BUILDAH_SOURCE_DATE_EPOCH\"\n  --rewrite-timestamp=\"$BUILDAH_REWRITE_TIMESTAMP\"\n  --squash=\"$SQUASH\"\n  --omit-history=\"$BUILDAH_OMIT_HISTORY\"\n  --image-source \"$SOURCE_URL\"\n  --image-revision \"$COMMIT_SHA\"\n  --quay-image-expires-after \"$IMAGE_EXPIRES_AFTER\"\n  --build-args-file \"$BUILD_ARGS_FILE\"\n  --annotations-file \"$ANNOTATIONS_FILE\"\n  --legacy-build-timestamp \"$BUILD_TIMESTAMP\"\n  --add-legacy-labels\n  --include-legacy-buildinfo-path=\"$ICM_KEEP_COMPAT_LOCATION\"\n  --skip-injections=\"$SKIP_INJECTIONS\"\n  --skip-unused-stages=\"$SKIP_UNUSED_STAGES\"\n  --hermetic=\"$HERMETIC\"\n  --image-pull-proxy \"$BUILDAH_HTTP_PROXY\"\n  --image-pull-noproxy \"$BUILDAH_NO_PROXY\"\n  --yum-repos-d-sources \"${yum_repos_d_sources[@]}\"\n  --yum-repos-d-target \"$YUM_REPOS_D_TARGET\"\n  --prefetch-dir \"$prefetch_dir\"\n  --prefetch-dir-copy \"$prefetch_dir_copy\"\n  --prefetch-env-mount /cachi2/cachi2.env\n  --prefetch-output-mount /cachi2/output\n  \"${security_args[@]}\"\n  \"${rhsm_args[@]}\"\n  --containerfile-json-output /shared/parsed_dockerfile.json\n  --resolved-base-images-output /shared/base_images_digests\n  --no-cache\n  --ulimits nofile=4096:4096\n  --src-tls-verify=\"$TLSVERIFY\"\n  --dest-tls-verify=\"$TLSVERIFY\"\n  --allow-cross-platform-images=\"$ALLOW_CROSS_PLATFORM_IMAGES\"\n  \"$@\" # --annotations, --labels, --envs, --build-args\n)\n\necho \"[$(date --utc -Ins)] $(printf '%q ' \"${cmd[@]}\")\"\n\n\"${cmd[@]}\"\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"${prefetch_dir}/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp \"${prefetch_dir}/output/bom.json\" ./sbom-prefetch.json\nfi\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "fj-multi-component-child-suum-on-push-x6hbt-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee \"/tekton/results/IMAGE_URL\"\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.1-1782136886@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/commit_sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xyhwgy",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-child-suum' (#1) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42/records/e761bfc1-961b-4697-b074-5d855ec52f57",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux"
                },
                "creationTimestamp": "2026-08-13T08:26:54Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:32:00Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-x6hbt",
                    "tekton.dev/pipelineRunUID": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min"
                },
                "name": "fj-multi-component-child-suum-on-push-x6hbt-build-image-index",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-x6hbt",
                        "uid": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42"
                    }
                ],
                "resourceVersion": "29418",
                "uid": "e761bfc1-961b-4697-b074-5d855ec52f57"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3.1@sha256:70679b88f57130e9a939a6765aacd976a9d66bfa5d1733fcee185dc07be39042"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:03Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:03Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-sucd691e952aad67003d45ddd2289f285e-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "70679b88f57130e9a939a6765aacd976a9d66bfa5d1733fcee185dc07be39042"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                    }
                ],
                "startTime": "2026-08-13T08:26:54Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://dbcf76e7f8fb248e5bd4e017b082f2402e03a15684c509b49520bdf49386555d",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:26:59Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:26:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5babf6439a211897b6c49c8206aeaa7fb9fee6106cf3a6c67fe554a3750d4281",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:00Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:00Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://13238e8943e96f94ba13da90764ed9410aaede57ce55461cd536f7973cc2a692",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:02Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:00Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "false"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3@sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"fj-multi-component-child-suum-on-push-x6hbt-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.1-1782136886@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/commit_sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xyhwgy",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-child-suum' (#1) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42/records/b731e8c1-7dc0-4afb-a076-537e671ac723",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:03Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:32:00Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-x6hbt",
                    "tekton.dev/pipelineRunUID": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min"
                },
                "name": "fj-multi-component-child-suum-on-push-x6hbt-clamav-scan",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-x6hbt",
                        "uid": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42"
                    }
                ],
                "resourceVersion": "29415",
                "uid": "b731e8c1-7dc0-4afb-a076-537e671ac723"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:9f7f5ca49400455e48ab2a1cce4759c7aab43c9a09e2a81714c8039efea5c811"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:52Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:52Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-suum-on-push-x6hbt-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f7f5ca49400455e48ab2a1cce4759c7aab43c9a09e2a81714c8039efea5c811"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\", \"digests\": [\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1786609668\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:03Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:dbe5e223cf38ee7d6ab01cafa1593605f31f6a204fad0afd9ffe5ac8650222d5",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://1807c390da89702159b9d05187176042e36347f8892152996f305e787d2f47d5",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:48Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\\\", \\\"digests\\\": [\\\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786609668\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:09Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5803a43d63a258f822cf3feaa0d3c1a768aa875859ec6cc964f3d09d8e4afe6d",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:52Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\\\", \\\"digests\\\": [\\\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786609668\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:49Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=\"content-${arch}\"\n    mkdir -p \"$destination\"\n    arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:2.1.0@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/commit_sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xyhwgy",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-child-suum' (#1) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42/records/c152ca74-2b4a-4af5-a144-56ecff33ce86",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git"
                },
                "creationTimestamp": "2026-08-13T08:24:20Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:32:00Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-x6hbt",
                    "tekton.dev/pipelineRunUID": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min"
                },
                "name": "fj-multi-component-child-suum-on-push-x6hbt-clone-repository",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-x6hbt",
                        "uid": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42"
                    }
                ],
                "resourceVersion": "29423",
                "uid": "c152ca74-2b4a-4af5-a144-56ecff33ce86"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                    },
                    {
                        "name": "revision",
                        "value": "617d2045b023b9c3874784751384ee4f2df6f1d3"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.2.4@sha256:f90deac0d63b43c7cb3f0b2d83ee56aa7fa18bb493f084286c6a953bbf479d8d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-xyhwgy"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:24:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:24:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-sud85aa82a48b6b4c03780dd6bf6458b8f-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "f90deac0d63b43c7cb3f0b2d83ee56aa7fa18bb493f084286c6a953bbf479d8d"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "617d2045b023b9c3874784751384ee4f2df6f1d3"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "617d2045b023b9c3874784751384ee4f2df6f1d3"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1786609445"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "617d204"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b"
                    }
                ],
                "startTime": "2026-08-13T08:24:20Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:fddbb4c2edb01a3f0065321f84cf2e4d8e483b4149e3d6f78dd0c46e85e35aef",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://b26b88112830cad070f90ff2b2043446b083ad6066a4e5ff3a45eb7eb98d12dc",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:24:27Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-child-jybppk\",\"type\":1},{\"key\":\"commit\",\"value\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1786609445\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"617d204\",\"type\":1},{\"key\":\"url\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-child-jybppk\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:24:24Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://7700fc9c0eebda5514c8dcfd78ded066c063d686367e5b3cc92657ee7bdbad04",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:24:30Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-child-jybppk\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b\",\"type\":1},{\"key\":\"commit\",\"value\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1786609445\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"617d204\",\"type\":1},{\"key\":\"url\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-child-jybppk\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:24:28Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level for the git-clone command.",
                            "name": "logLevel",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Minimum length of the short commit SHA. Git may return a longer prefix if needed for uniqueness.",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched. Empty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "CSV list of path patterns to exclude from the symlink check. Symlinks whose paths match\nare not checked. Patterns are relative to the checkout directory and must not start with '/'.\nUse '*' and '?' as wildcards ('*' matches across '/').\nQuote patterns containing commas using CSV double quotes.\n",
                            "name": "symlinkCheckIgnorePattern",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "Abbreviated commit SHA for the checkout. At least params.shortCommitLength characters; longer if Git requires more for uniqueness.",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_GIT_CLONE_URL",
                                    "value": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_REVISION",
                                    "value": "617d2045b023b9c3874784751384ee4f2df6f1d3"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_REFSPEC"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SYMLINK_CHECK_IGNORE_PATTERN"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_BASIC_AUTH_DIRECTORY",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SSH_DIRECTORY"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_OUTPUT_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBDIRECTORY",
                                    "value": "source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:fddbb4c2edb01a3f0065321f84cf2e4d8e483b4149e3d6f78dd0c46e85e35aef",
                            "name": "clone",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf \"$ca_bundle\" /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\nRESULT_FILE=\"$(mktemp)\"\nkonflux-build-cli git-clone \u003e\"${RESULT_FILE}\"\n\nprintf \"%s\" \"$(jq -r '.commit' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"$(jq -r '.shortCommit' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"$(jq -r '.url' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"$(jq -r '.commitTimestamp' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/commit-timestamp\"\nprintf \"%s\" \"$(jq -r '.\"CHAINS-GIT_URL\"' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(jq -r '.\"CHAINS-GIT_COMMIT\"' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\n\nMERGED_SHA=$(jq -r '.mergedSha // empty' \"${RESULT_FILE}\")\nif [ -n \"${MERGED_SHA}\" ]; then\n  printf \"%s\" \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/commit_sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xyhwgy",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-child-suum' (#1) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42/records/c9927feb-50e0-4eef-8ec8-e059e9b62768",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:24:16Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:32:00Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-x6hbt",
                    "tekton.dev/pipelineRunUID": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init"
                },
                "name": "fj-multi-component-child-suum-on-push-x6hbt-init",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-x6hbt",
                        "uid": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42"
                    }
                ],
                "resourceVersion": "29409",
                "uid": "c9927feb-50e0-4eef-8ec8-e059e9b62768"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:24:20Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:24:20Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-suum-on-push-x6hbt-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "startTime": "2026-08-13T08:24:16Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5deaff8258663df334b4e1d98b8c29d3818ca4ed2144f3b8763f2d7375257308",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:24:19Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:24:19Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/commit_sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xyhwgy",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-child-suum' (#1) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42/records/26c5cb89-ea84-4db0-9550-813c8dc5278c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "results.tekton.dev/stored": "true"
                },
                "creationTimestamp": "2026-08-13T08:27:03Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:32:00Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-x6hbt",
                    "tekton.dev/pipelineRunUID": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan"
                },
                "name": "fj-multi-component-child-suum-on-push-x6hbt-rpms-signature-scan",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-x6hbt",
                        "uid": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42"
                    }
                ],
                "resourceVersion": "29419",
                "uid": "26c5cb89-ea84-4db0-9550-813c8dc5278c"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:ccb77d1bf7627fc6241a59ed42bb6e5707a8682754fe8ae18f2cfdddbcf29275"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:19Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:19Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-suf9c235bdf7d46ec9a6f2f21a82703fa6-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ccb77d1bf7627fc6241a59ed42bb6e5707a8682754fe8ae18f2cfdddbcf29275"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\", \"digests\": [\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"199e2f91fd431d51\": 102, \"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:27:19+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:04Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:816a2ad35037f3233903278371f766102735f96cfaf48a9663ce5b858cec34b3",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://cbb1eb8eb21e2f2bb2eed0047e11e18f75d48fad5bc8fc9e53aac67f757f7ed0",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:18Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://dfc56a9776ec13733b43aa875592341b4b64b0a2a5ea7e9c245d5e09b58c3e77",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:19Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\\\", \\\"digests\\\": [\\\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"199e2f91fd431d51\\\": 102, \\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:19+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:18Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:816a2ad35037f3233903278371f766102735f96cfaf48a9663ce5b858cec34b3",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/commit_sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xyhwgy",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-child-suum' (#1) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42/records/d098c477-ad38-4980-be1e-725e866beaf6",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:03Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:32:00Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-x6hbt",
                    "tekton.dev/pipelineRunUID": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min"
                },
                "name": "fj-multi-component-child-suum-on-push-x6hbt-sast-shell-check",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-x6hbt",
                        "uid": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42"
                    }
                ],
                "resourceVersion": "29464",
                "uid": "d098c477-ad38-4980-be1e-725e866beaf6"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:b25a46b20e09eacec4e177cdd8d18a31fea38e9e346b49215e6e5044a00b8d85"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:22Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:22Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-suac850a754a13122fb53055b88f317a17-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "b25a46b20e09eacec4e177cdd8d18a31fea38e9e346b49215e6e5044a00b8d85"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:27:19+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:03Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://ec1cc0e5e2d2430f561555ce9d11685c82f3db5c299b850d2595f85556c26657",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:11Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://441fd481eba8dfd3be0aeea4447d0e29bc8116bc2fbe388979c0783bffbbf85e",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:20Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:19+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:11Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://298557451a0e6bc5e7cc48f5650006b9a2c84039cb129c566b79e9e7cdf25e2b",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:21Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:19+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:20Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip files containing Jinja2 template syntax ({{ }}, {% %}, {# #}). ShellCheck cannot parse Jinja2 constructs, so scanning such files produces unreliable findings.",
                            "name": "SKIP_JINJA",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SKIP_JINJA",
                                    "value": "true"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\nif [[ \"${SKIP_JINJA}\" == \"true\" ]]; then\n  export SC_SKIP_JINJA=1\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/commit_sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xyhwgy",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-child-suum' (#1) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42/records/317dc6a0-0ff1-41e8-a48d-e74f7b87b70c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:03Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:32:00Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-x6hbt",
                    "tekton.dev/pipelineRunUID": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min"
                },
                "name": "fj-multi-component-child-suum-on-push-x6hbt-sast-unicode-check",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-x6hbt",
                        "uid": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42"
                    }
                ],
                "resourceVersion": "29414",
                "uid": "317dc6a0-0ff1-41e8-a48d-e74f7b87b70c"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:80bf85aebf99a9d26c2d3fae3d90ee6bfe28246e3b0bbd950934ceba764bc067"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:14Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:14Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-su3012902b5b9e367331c3a3fd02ce8778-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "80bf85aebf99a9d26c2d3fae3d90ee6bfe28246e3b0bbd950934ceba764bc067"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:27:11+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:03Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://352803d0dda83dc63cfc72f5c3277e34a836bc933ec5a664937116fc4952d4b7",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:09Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:09Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://9f52bb163bd66c48c95e40bd1011d212f3d8cb8208efe4865e55c5a1b7c4f5b5",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:11Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:11+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:10Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://339322b1ed447da3559ff4d55cbd8217b15ef82aebbeffac05e58d53fba63c2e",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:13Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:11+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:12Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum@sha256:9532dfb6d227ffd63ed2a9eef0b875089d6c395f3e6d07b5d04474b89bf15a4b=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/commit_sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "build.appstudio.redhat.com/target_branch": "multi-component-child-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-xyhwgy",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-child-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-child-suum' (#1) from konflux-fj-multi-component-child-suum into multi-component-child-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk/commit/617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-child-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42/records/724653e9-6874-4e0f-ad64-5dc4f1f1cafd",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-child-jybppk\",\"commit\":\"617d2045b023b9c3874784751384ee4f2df6f1d3\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:03Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:32:00Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-child-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-child-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-child-jybppk",
                    "pipelinesascode.tekton.dev/sha": "617d2045b023b9c3874784751384ee4f2df6f1d3",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-child-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-child-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-child-suum-on-push-x6hbt",
                    "tekton.dev/pipelineRunUID": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan"
                },
                "name": "fj-multi-component-child-suum-on-push-x6hbt-tpa-scan",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-child-suum-on-push-x6hbt",
                        "uid": "dd3b5e1f-41b8-44d3-9c65-f787f2173c42"
                    }
                ],
                "resourceVersion": "29407",
                "uid": "724653e9-6874-4e0f-ad64-5dc4f1f1cafd"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-child-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:6a204cecc1a1091bf928b3db5a4082735c2111f90befdb5b043c498833c02bcf"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:22Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:22Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-child-suum-on-push-x6hbt-tpa-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "6a204cecc1a1091bf928b3db5a4082735c2111f90befdb5b043c498833c02bcf"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\", \"digests\": [\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\":\"sha256:f33a5ec96b45a0507c0b81f1928cbaa9eee801c3e36af2267ad611b77568510a\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:27:21+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:04Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://2323ef1cad4e5dcd198a59cb0452441526cc783cd15c4de1e702908519140bc5",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:17Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://90471de45891d782e967925ea730fd67278f2b07dfadb4d3596e97e51d8aa00f",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:20Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:17Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://7a3c781f0c08fe6b375573b89c198bdbecf185cbfb144f34f4a8313b99ad0898",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:21Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3\\\", \\\"digests\\\": [\\\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c\\\":\\\"sha256:f33a5ec96b45a0507c0b81f1928cbaa9eee801c3e36af2267ad611b77568510a\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:21+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:20Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:52af206d4c2f2462afafb703da3c11615a0d68991ba70b9c6f385628d8e5ac4c"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-child-suum:617d2045b023b9c3874784751384ee4f2df6f1d3"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:2.1.0@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/commit_sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-qctpiq",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-parent-suum' (#1) from konflux-fj-multi-component-parent-suum into multi-component-parent-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077/records/300a5ab0-b471-4538-bec6-9c0b5d3c9bed",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-jybppk\",\"commit\":\"4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux"
                },
                "creationTimestamp": "2026-08-13T08:25:34Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-parent-suum",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-parent-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-parent-suum-on-push-z5mgc",
                    "tekton.dev/pipelineRunUID": "4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min"
                },
                "name": "fj-multi-component-parent-suum-on-push-z5mgc-build-container",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-parent-suum-on-push-z5mgc",
                        "uid": "4293ea80-6fa0-4667-8c9b-d77eeb295077"
                    }
                ],
                "resourceVersion": "29110",
                "uid": "300a5ab0-b471-4538-bec6-9c0b5d3c9bed"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": ""
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "4078a4ebb0417957bc45298dcbcc6fef778ef833"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_DATE_EPOCH",
                        "value": ""
                    },
                    {
                        "name": "REWRITE_TIMESTAMP",
                        "value": "false"
                    },
                    {
                        "name": "OMIT_HISTORY",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-parent-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.10.5@sha256:de644e1dee81463bd47e4e5a33688d4ef40cd963f0a17fccc9cf11ca92eea471"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:30Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:30Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-parent-s0c6ceed56b9dc7aff31692c91ecbd17a-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "de644e1dee81463bd47e4e5a33688d4ef40cd963f0a17fccc9cf11ca92eea471"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:d1913654a19ab2ce8d85fd0ceda6f7e3dab91b3e0ec225b5f47b286a6cc325ee"
                    }
                ],
                "startTime": "2026-08-13T08:25:34Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://4185c6c2d38ce01293904381829271cafc6cd6abe10539747f4b41de5db7a13b",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:41Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:40Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://e963b2a7427ad5334c0d62cce9140b08158b8ac33de8220041e73107e96d48cc",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:25:57Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:42Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://2f1f80c2de7d32aebc5dbf1e6c0ae342b78f5bbe2426b00b25afdaac804710ef",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:26:39Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:25:57Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://ff2b6f0df320d0c4c68cababa12d697a8b4685be20409feb400cf5442a73f181",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:26:52Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:26:40Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5acd2913c47fe64b278dbf095588d9ce62af4c2c4e090daa25e54d597b53c0db",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:06Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:26:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://349960200efab927905273f1263577b25afdec2be07ae90d0eb03a599ee5a613",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:29Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:d1913654a19ab2ce8d85fd0ceda6f7e3dab91b3e0ec225b5f47b286a6cc325ee\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:06Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Allows to use parent images that don't match the build host architecture. This option must be used with caution as it may create incompatible images.",
                            "name": "ALLOW_CROSS_PLATFORM_IMAGES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "info",
                            "description": "Log level for the build command.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "auto",
                            "description": "Mount /etc/rhsm/ca from the host machine into the build. Valid values are 'always', 'auto' (default), 'never'. Only effective if HERMETIC=false and ACTIVATION_KEY or ENTITLEMENT_SECRET is set.",
                            "name": "RHSM_MOUNT_CA_CERTS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ALLOW_CROSS_PLATFORM_IMAGES",
                                "value": "false"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "KBC_LOG_LEVEL",
                                "value": "info"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "RHSM_MOUNT_CA_CERTS",
                                "value": "auto"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--envs",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "4078a4ebb0417957bc45298dcbcc6fef778ef833"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  echo \"[$(date --utc -Ins)] Update CA trust\"\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Delete policy settings for Red Hat registries to disable signature verification.\n# TODO: don't do this?\ncontainer_policy=$(\n  jq '.transports |= (\n        del(.docker.[\"registry.access.redhat.com\"]) |\n        del(.docker.[\"registry.redhat.io\"]) |\n        if (.docker == {}) then del(.docker) else . end\n      )' /etc/containers/policy.json\n)\necho \"Effective container policy:\"\nprintf '%s\\n' \"$container_policy\" | tee /etc/containers/policy.json\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\necho \"[$(date --utc -Ins)] Run the build\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  ANNOTATIONS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\")\nfi\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILD_ARGS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nsecurity_args=(--security-opts unmask=/proc/interrupts)\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  security_args+=(--security-opts label=disable)\n  security_args+=(--cap-add all)\n  security_args+=(--devices /dev/fuse)\nfi\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  security_args+=(--cap-add \"${ADD_CAPABILITIES}\")\nfi\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  prefetch_dir=\"/var/workdir/cachi2\"\n  # KBC defaults to ${prefetch_dir}/copy-*\n  # Copy to a sibling dir instead in case we don't have write permissions to the prefetch_dir.\n  # It's still on the same filesystem, so copying via reflinks should be possible.\n  prefetch_dir_copy=\"/var/workdir/prefetch-copy\"\nelse\n  prefetch_dir=\"\"\n  prefetch_dir_copy=\"\"\nfi\n\nyum_repos_d_sources=()\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  yum_repos_d_sources+=(\"${YUM_REPOS_D_FETCHED}\")\nfi\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  yum_repos_d_sources+=(\"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\")\nfi\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 4. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    to \"/etc/pki/entitlement\" to prevent certificates from being included\nrhsm_args=()\nif [ \"${HERMETIC}\" != \"true\" ]; then\n  if [ -e /activation-key/org ]; then\n    rhsm_args+=(--rhsm-activation-key=/activation-key/activationkey\n      --rhsm-org=/activation-key/org\n      --rhsm-activation-mount=/activation-key)\n\n    if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n      # user is not running registration in the Containerfile: pre-register.\n      rhsm_args+=(--rhsm-activation-preregister)\n    fi\n  elif find /entitlement -name \"*.pem\" \u003e/dev/null; then\n    rhsm_args+=(--rhsm-entitlements=/entitlement)\n  fi\nfi\nif [ \"${RHSM_MOUNT_CA_CERTS}\" != \"auto\" ]; then\n  rhsm_args+=(--rhsm-mount-ca-certs=\"$RHSM_MOUNT_CA_CERTS\")\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\ncmd=(\n  konflux-build-cli image build\n  -f \"$dockerfile_path\" -t \"$IMAGE\" --source \"$SOURCE_CODE_DIR\" --context \"$CONTEXT\"\n  --secret-dirs \"src=/additional-secret,name=$ADDITIONAL_SECRET,optional=true\"\n  --workdir-mount \"$WORKINGDIR_MOUNT\"\n  --target \"$TARGET_STAGE\"\n  --inherit-labels=\"$INHERIT_BASE_IMAGE_LABELS\"\n  --source-date-epoch \"$BUILDAH_SOURCE_DATE_EPOCH\"\n  --rewrite-timestamp=\"$BUILDAH_REWRITE_TIMESTAMP\"\n  --squash=\"$SQUASH\"\n  --omit-history=\"$BUILDAH_OMIT_HISTORY\"\n  --image-source \"$SOURCE_URL\"\n  --image-revision \"$COMMIT_SHA\"\n  --quay-image-expires-after \"$IMAGE_EXPIRES_AFTER\"\n  --build-args-file \"$BUILD_ARGS_FILE\"\n  --annotations-file \"$ANNOTATIONS_FILE\"\n  --legacy-build-timestamp \"$BUILD_TIMESTAMP\"\n  --add-legacy-labels\n  --include-legacy-buildinfo-path=\"$ICM_KEEP_COMPAT_LOCATION\"\n  --skip-injections=\"$SKIP_INJECTIONS\"\n  --skip-unused-stages=\"$SKIP_UNUSED_STAGES\"\n  --hermetic=\"$HERMETIC\"\n  --image-pull-proxy \"$BUILDAH_HTTP_PROXY\"\n  --image-pull-noproxy \"$BUILDAH_NO_PROXY\"\n  --yum-repos-d-sources \"${yum_repos_d_sources[@]}\"\n  --yum-repos-d-target \"$YUM_REPOS_D_TARGET\"\n  --prefetch-dir \"$prefetch_dir\"\n  --prefetch-dir-copy \"$prefetch_dir_copy\"\n  --prefetch-env-mount /cachi2/cachi2.env\n  --prefetch-output-mount /cachi2/output\n  \"${security_args[@]}\"\n  \"${rhsm_args[@]}\"\n  --containerfile-json-output /shared/parsed_dockerfile.json\n  --resolved-base-images-output /shared/base_images_digests\n  --no-cache\n  --ulimits nofile=4096:4096\n  --src-tls-verify=\"$TLSVERIFY\"\n  --dest-tls-verify=\"$TLSVERIFY\"\n  --allow-cross-platform-images=\"$ALLOW_CROSS_PLATFORM_IMAGES\"\n  \"$@\" # --annotations, --labels, --envs, --build-args\n)\n\necho \"[$(date --utc -Ins)] $(printf '%q ' \"${cmd[@]}\")\"\n\n\"${cmd[@]}\"\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"${prefetch_dir}/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp \"${prefetch_dir}/output/bom.json\" ./sbom-prefetch.json\nfi\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "fj-multi-component-parent-suum-on-push-z5mgc-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee \"/tekton/results/IMAGE_URL\"\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.1-1782136886@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/commit_sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-qctpiq",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-parent-suum' (#1) from konflux-fj-multi-component-parent-suum into multi-component-parent-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077/records/2ff22897-983f-4753-a840-308c8cd56d9e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-jybppk\",\"commit\":\"4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:30Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-parent-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-parent-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-parent-suum-on-push-z5mgc",
                    "tekton.dev/pipelineRunUID": "4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min"
                },
                "name": "fj-multi-component-parent-suum-on-push-z5mgc-build-image-index",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-parent-suum-on-push-z5mgc",
                        "uid": "4293ea80-6fa0-4667-8c9b-d77eeb295077"
                    }
                ],
                "resourceVersion": "29114",
                "uid": "2ff22897-983f-4753-a840-308c8cd56d9e"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-parent-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3.1@sha256:70679b88f57130e9a939a6765aacd976a9d66bfa5d1733fcee185dc07be39042"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:39Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:39Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-parent-s7c298d11b1c7497596c4a7df200df409-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "70679b88f57130e9a939a6765aacd976a9d66bfa5d1733fcee185dc07be39042"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                    }
                ],
                "startTime": "2026-08-13T08:27:30Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://ac4331b32a19f0e01729eef84e4deeca1363f27653337995ee84ea5c043c7c7b",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:36Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:34Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://dced7c1db86d5e621a5536243fc3637ba731fc44fd449e14778f74b77e1e3998",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:36Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:36Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://933ba415401a72006a703563ea0f5142c7cf0a088c10de46d65ac6e22e59393f",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:38Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:37Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "false"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833@sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"fj-multi-component-parent-suum-on-push-z5mgc-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.1-1782136886@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/commit_sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-qctpiq",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-parent-suum' (#1) from konflux-fj-multi-component-parent-suum into multi-component-parent-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077/records/124217a3-7cf0-41c2-8216-2b1d4713c432",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-jybppk\",\"commit\":\"4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:39Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-parent-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-parent-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-parent-suum-on-push-z5mgc",
                    "tekton.dev/pipelineRunUID": "4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min"
                },
                "name": "fj-multi-component-parent-suum-on-push-z5mgc-clamav-scan",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-parent-suum-on-push-z5mgc",
                        "uid": "4293ea80-6fa0-4667-8c9b-d77eeb295077"
                    }
                ],
                "resourceVersion": "29099",
                "uid": "124217a3-7cf0-41c2-8216-2b1d4713c432"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-parent-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:9f7f5ca49400455e48ab2a1cce4759c7aab43c9a09e2a81714c8039efea5c811"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:28:30Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:28:30Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-parent-suum-on-push-z5mgc-clamav-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f7f5ca49400455e48ab2a1cce4759c7aab43c9a09e2a81714c8039efea5c811"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833\", \"digests\": [\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1786609706\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:39Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:dbe5e223cf38ee7d6ab01cafa1593605f31f6a204fad0afd9ffe5ac8650222d5",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://b62fba5abe4b837c4e537bd575bc2d32f2b2265c2dae27480db0242182242470",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:28:26Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833\\\", \\\"digests\\\": [\\\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786609706\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://41e30035aae62d45a1a9f1870af428af99ad80c9f9d905c40efbb9ccc55bc481",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:28:29Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833\\\", \\\"digests\\\": [\\\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786609706\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:28:26Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=\"content-${arch}\"\n    mkdir -p \"$destination\"\n    arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:2.1.0@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/commit_sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-qctpiq",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-parent-suum' (#1) from konflux-fj-multi-component-parent-suum into multi-component-parent-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077/records/4e3ab92d-75cb-46e1-a7e0-36fe1e0aa946",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-jybppk\",\"commit\":\"4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git"
                },
                "creationTimestamp": "2026-08-13T08:24:46Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-parent-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-parent-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-parent-suum-on-push-z5mgc",
                    "tekton.dev/pipelineRunUID": "4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min"
                },
                "name": "fj-multi-component-parent-suum-on-push-z5mgc-clone-repository",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-parent-suum-on-push-z5mgc",
                        "uid": "4293ea80-6fa0-4667-8c9b-d77eeb295077"
                    }
                ],
                "resourceVersion": "29111",
                "uid": "4e3ab92d-75cb-46e1-a7e0-36fe1e0aa946"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk"
                    },
                    {
                        "name": "revision",
                        "value": "4078a4ebb0417957bc45298dcbcc6fef778ef833"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-parent-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.2.4@sha256:f90deac0d63b43c7cb3f0b2d83ee56aa7fa18bb493f084286c6a953bbf479d8d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-qctpiq"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:24:56Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:24:56Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-parent-s1e90fc0e95b0d0d3d344527ecf859ddb-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "f90deac0d63b43c7cb3f0b2d83ee56aa7fa18bb493f084286c6a953bbf479d8d"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "4078a4ebb0417957bc45298dcbcc6fef778ef833"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "4078a4ebb0417957bc45298dcbcc6fef778ef833"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1786609464"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "4078a4e"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9"
                    }
                ],
                "startTime": "2026-08-13T08:24:46Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:fddbb4c2edb01a3f0065321f84cf2e4d8e483b4149e3d6f78dd0c46e85e35aef",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://412ef169b29af583b9228cfe8a97cfd69388f121c60888804aaf47f9ece4abfb",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:24:53Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-parent-jybppk\",\"type\":1},{\"key\":\"commit\",\"value\":\"4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1786609464\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"4078a4e\",\"type\":1},{\"key\":\"url\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-parent-jybppk\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:24:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5169a97482865924f364c41ff91346d0cf40d0a1c67c69d50b288aac8c18beaa",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:24:55Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-parent-jybppk\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9\",\"type\":1},{\"key\":\"commit\",\"value\":\"4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1786609464\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"4078a4e\",\"type\":1},{\"key\":\"url\",\"value\":\"https://codeberg.org/konflux-qe/build-nudge-parent-jybppk\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:24:54Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level for the git-clone command.",
                            "name": "logLevel",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Minimum length of the short commit SHA. Git may return a longer prefix if needed for uniqueness.",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched. Empty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "CSV list of path patterns to exclude from the symlink check. Symlinks whose paths match\nare not checked. Patterns are relative to the checkout directory and must not start with '/'.\nUse '*' and '?' as wildcards ('*' matches across '/').\nQuote patterns containing commas using CSV double quotes.\n",
                            "name": "symlinkCheckIgnorePattern",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "Abbreviated commit SHA for the checkout. At least params.shortCommitLength characters; longer if Git requires more for uniqueness.",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_GIT_CLONE_URL",
                                    "value": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_REVISION",
                                    "value": "4078a4ebb0417957bc45298dcbcc6fef778ef833"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_REFSPEC"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SYMLINK_CHECK_IGNORE_PATTERN"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_BASIC_AUTH_DIRECTORY",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SSH_DIRECTORY"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_OUTPUT_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBDIRECTORY",
                                    "value": "source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:fddbb4c2edb01a3f0065321f84cf2e4d8e483b4149e3d6f78dd0c46e85e35aef",
                            "name": "clone",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf \"$ca_bundle\" /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\nRESULT_FILE=\"$(mktemp)\"\nkonflux-build-cli git-clone \u003e\"${RESULT_FILE}\"\n\nprintf \"%s\" \"$(jq -r '.commit' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"$(jq -r '.shortCommit' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"$(jq -r '.url' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"$(jq -r '.commitTimestamp' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/commit-timestamp\"\nprintf \"%s\" \"$(jq -r '.\"CHAINS-GIT_URL\"' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(jq -r '.\"CHAINS-GIT_COMMIT\"' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\n\nMERGED_SHA=$(jq -r '.mergedSha // empty' \"${RESULT_FILE}\")\nif [ -n \"${MERGED_SHA}\" ]; then\n  printf \"%s\" \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/commit_sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-qctpiq",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-parent-suum' (#1) from konflux-fj-multi-component-parent-suum into multi-component-parent-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077/records/776426dd-2236-4565-ab9a-745f7a72392d",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-jybppk\",\"commit\":\"4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:39Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-parent-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-parent-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-parent-suum-on-push-z5mgc",
                    "tekton.dev/pipelineRunUID": "4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min"
                },
                "name": "fj-multi-component-parent-suum-on-push-z5mgc-sast-shell-check",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-parent-suum-on-push-z5mgc",
                        "uid": "4293ea80-6fa0-4667-8c9b-d77eeb295077"
                    }
                ],
                "resourceVersion": "29102",
                "uid": "776426dd-2236-4565-ab9a-745f7a72392d"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-parent-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:b25a46b20e09eacec4e177cdd8d18a31fea38e9e346b49215e6e5044a00b8d85"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:28:00Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:28:00Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-parent-s72d918f4934f33f084e32c396183e037-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "b25a46b20e09eacec4e177cdd8d18a31fea38e9e346b49215e6e5044a00b8d85"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:27:56+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:40Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://dcb00fe76d16d8fe49afe661171c05287389f5ea7c7faf6d506cb293f1214393",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:48Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://a142bf0e569507ffbfc40f015dbd9b512cd09288de7d7d5a8fe4c57c51e87d0b",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:56Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:56+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://471d7274661e5ab8f3f69324a3d5f628a1c1c49c7808ecf7295604f709ffcb35",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:59Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:56+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:57Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip files containing Jinja2 template syntax ({{ }}, {% %}, {# #}). ShellCheck cannot parse Jinja2 constructs, so scanning such files produces unreliable findings.",
                            "name": "SKIP_JINJA",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SKIP_JINJA",
                                    "value": "true"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\nif [[ \"${SKIP_JINJA}\" == \"true\" ]]; then\n  export SC_SKIP_JINJA=1\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/commit_sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-qctpiq",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-parent-suum' (#1) from konflux-fj-multi-component-parent-suum into multi-component-parent-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077/records/6081bb43-60d7-454f-bdf9-bcf156e41961",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-jybppk\",\"commit\":\"4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:39Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-parent-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-parent-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-parent-suum-on-push-z5mgc",
                    "tekton.dev/pipelineRunUID": "4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min"
                },
                "name": "fj-multi-component-parent-suum-on-push-z5mgc-sast-unicode-check",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-parent-suum-on-push-z5mgc",
                        "uid": "4293ea80-6fa0-4667-8c9b-d77eeb295077"
                    }
                ],
                "resourceVersion": "29103",
                "uid": "6081bb43-60d7-454f-bdf9-bcf156e41961"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-parent-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:80bf85aebf99a9d26c2d3fae3d90ee6bfe28246e3b0bbd950934ceba764bc067"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:27:52Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:27:52Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-parent-s0f170e74d827810d22f319a8b7b82bc9-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "80bf85aebf99a9d26c2d3fae3d90ee6bfe28246e3b0bbd950934ceba764bc067"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:27:50+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:40Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://b1f865e539e9a66e2ed8adef5d33afa79b7132a227146a100656e70a98853c5f",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://135bb2753e03e9b1ecece41ecb1dcec32e5430a0d4992f8cfb37c7777529cb94",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:50Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:50+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5be09111c9dfb01397f993772e2238db07dcc8c18efd6d4e7263f13b34ea880a",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:51Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:50+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum@sha256:8ff3ffe6d746bc5b0ae8c3ea6ff0bed911ace28cce8c721fd207caa5a6b85cd9=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/commit_sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/target_branch": "multi-component-parent-base-suum",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-qctpiq",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-parent-base-suum\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-multi-component-parent-suum' (#1) from konflux-fj-multi-component-parent-suum into multi-component-parent-base-suum\n",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk/commit/4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-parent-base-suum",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077/records/aa5910ca-06df-44c1-9c6d-f7e069ff93c4",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"build-nudge-parent-jybppk\",\"commit\":\"4078a4ebb0417957bc45298dcbcc6fef778ef833\",\"eventType\":\"push\"}",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux"
                },
                "creationTimestamp": "2026-08-13T08:27:39Z",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "2026-08-13T08:31:44Z",
                "finalizers": [
                    "results.tekton.dev/taskrun"
                ],
                "generation": 2,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-component-update-dtsm",
                    "appstudio.openshift.io/component": "fj-multi-component-parent-suum",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "false",
                    "pipelinesascode.tekton.dev/event-type": "push",
                    "pipelinesascode.tekton.dev/original-prname": "fj-multi-component-parent-suum-on-push",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-build-nudge-parent-jybppk",
                    "pipelinesascode.tekton.dev/sha": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "build-nudge-parent-jybppk",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-multi-component-parent-suum-on-push",
                    "tekton.dev/pipelineRun": "fj-multi-component-parent-suum-on-push-z5mgc",
                    "tekton.dev/pipelineRunUID": "4293ea80-6fa0-4667-8c9b-d77eeb295077",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan"
                },
                "name": "fj-multi-component-parent-suum-on-push-z5mgc-tpa-scan",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-multi-component-parent-suum-on-push-z5mgc",
                        "uid": "4293ea80-6fa0-4667-8c9b-d77eeb295077"
                    }
                ],
                "resourceVersion": "29106",
                "uid": "aa5910ca-06df-44c1-9c6d-f7e069ff93c4"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-multi-component-parent-suum",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:6a204cecc1a1091bf928b3db5a4082735c2111f90befdb5b043c498833c02bcf"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:28:00Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:28:00Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-multi-component-parent-suum-on-push-z5mgc-tpa-scan-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "6a204cecc1a1091bf928b3db5a4082735c2111f90befdb5b043c498833c02bcf"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833\", \"digests\": [\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\":\"sha256:430069a353c03535de30f2bb269e311fc5ef5f3575700ec7aaa8c17c33d0ec75\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:27:59+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:27:41Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://921f836a64521119f8f341f81d60f3d593e37e62584558ec779754c552969e1d",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:55Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:50Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://3638266712a8e71fc57c39c18512a195f66ce23bc7bb20ec28401bed0b49d28f",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:58Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://d42c665d0fb2430790f11efa0bd81e8bf51b60395415f3a15292443aa7ea5f8a",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:27:59Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833\\\", \\\"digests\\\": [\\\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151\\\":\\\"sha256:430069a353c03535de30f2bb269e311fc5ef5f3575700ec7aaa8c17c33d0ec75\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:27:59+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:27:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:82b98e4d8ba41691b9d493988a737d8b174cb7963971d7806fb4d887bff1b151"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:2.1.0@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.redhat.com/nudged-components": "fj-multi-component-child-suum",
                    "build.appstudio.redhat.com/nudging-commit": "4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/nudging-component": "fj-multi-component-parent-suum",
                    "build.appstudio.redhat.com/nudging-image": "quay.io/redhat-appstudio-qe/build-e2e-sdcf/fj-multi-component-parent-suum:4078a4ebb0417957bc45298dcbcc6fef778ef833",
                    "build.appstudio.redhat.com/nudging-pipeline": "fj-multi-component-parent-suum-on-push-z5mgc",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-sdcf/results/d86f2d9d-7434-45a3-be12-dec6ba647ca3/records/1c7fc885-eaf5-4f78-8555-dc98c0f0a0e0",
                    "results.tekton.dev/result": "build-e2e-sdcf/results/d86f2d9d-7434-45a3-be12-dec6ba647ca3",
                    "results.tekton.dev/stored": "true"
                },
                "creationTimestamp": "2026-08-13T08:28:30Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "tekton-pipelines",
                    "build.appstudio.redhat.com/type": "nudge",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "renovate-pipeline-1786609710-0cc8c",
                    "tekton.dev/pipelineRun": "renovate-pipeline-1786609710-0cc8c",
                    "tekton.dev/pipelineRunUID": "d86f2d9d-7434-45a3-be12-dec6ba647ca3",
                    "tekton.dev/pipelineTask": "renovate"
                },
                "name": "renovate-pipeline-1786609710-0cc8c-renovate",
                "namespace": "build-e2e-sdcf",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "renovate-pipeline-1786609710-0cc8c",
                        "uid": "d86f2d9d-7434-45a3-be12-dec6ba647ca3"
                    }
                ],
                "resourceVersion": "28497",
                "uid": "1c7fc885-eaf5-4f78-8555-dc98c0f0a0e0"
            },
            "spec": {
                "serviceAccountName": "build-pipeline-fj-multi-component-parent-suum",
                "taskSpec": {
                    "steps": [
                        {
                            "command": [
                                "bash",
                                "-c",
                                "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_fb083bc434 RENOVATE_CONFIG_FILE=/configs/fj-multi-component-child-suum-b2820.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_sdcf_fj_multi_component_parent_suum_71d807f806','password':'${TOKEN_1784a38675}'}]\" renovate"
                            ],
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                }
                            ],
                            "envFrom": [
                                {
                                    "prefix": "TOKEN_",
                                    "secretRef": {
                                        "name": "renovate-pipeline-1786609710-0cc8c"
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31",
                            "name": "renovate",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "seccompProfile": {
                                    "type": "RuntimeDefault"
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/configs",
                                    "name": "renovate-pipeline-1786609710-0cc8c"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "name": "renovate-pipeline-1786609710-0cc8c"
                            },
                            "name": "renovate-pipeline-1786609710-0cc8c"
                        }
                    ]
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:31:18Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:31:18Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "renovate-pipeline-1786609710-0cc8c-renovate-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    }
                },
                "startTime": "2026-08-13T08:28:30Z",
                "steps": [
                    {
                        "container": "step-renovate",
                        "imageID": "quay.io/konflux-ci/mintmaker-renovate-image@sha256:67d26b20533790565a2949a3f732d595dda9378fea506f1cba88ca17cef13873",
                        "name": "renovate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://dbef250f0ab12651b2fc7ae2d7753a0c6db33a0c684ee1b75a47f667bc7c07c7",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:31:18Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:31:02Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "steps": [
                        {
                            "command": [
                                "bash",
                                "-c",
                                "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_fb083bc434 RENOVATE_CONFIG_FILE=/configs/fj-multi-component-child-suum-b2820.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_sdcf_fj_multi_component_parent_suum_71d807f806','password':'${TOKEN_1784a38675}'}]\" renovate"
                            ],
                            "computeResources": {},
                            "env": [
                                {
                                    "name": "LOG_LEVEL",
                                    "value": "debug"
                                }
                            ],
                            "envFrom": [
                                {
                                    "prefix": "TOKEN_",
                                    "secretRef": {
                                        "name": "renovate-pipeline-1786609710-0cc8c"
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31",
                            "name": "renovate",
                            "securityContext": {
                                "allowPrivilegeEscalation": false,
                                "capabilities": {
                                    "drop": [
                                        "ALL"
                                    ]
                                },
                                "runAsNonRoot": true,
                                "seccompProfile": {
                                    "type": "RuntimeDefault"
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/configs",
                                    "name": "renovate-pipeline-1786609710-0cc8c"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "name": "renovate-pipeline-1786609710-0cc8c"
                            },
                            "name": "renovate-pipeline-1786609710-0cc8c"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/commit_sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "default",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "default",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fjwlxg",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"default\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c/records/1b15aaf0-ccb7-4d87-9961-7d1c2ffbef9b",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-aadpde\",\"commit\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-test-custom-default-yvxxpm"
                },
                "creationTimestamp": "2026-08-13T08:22:19Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-test-application-tewl",
                    "appstudio.openshift.io/component": "fj-test-custom-default-yvxxpm",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                    "tekton.dev/pipelineRunUID": "7bc31381-1a07-4292-b159-a319b4c5753c",
                    "tekton.dev/pipelineTask": "deprecated-base-image-check",
                    "tekton.dev/task": "deprecated-image-check",
                    "test.appstudio.openshift.io/pr-group-sha": "04614a78cb064f85908ed6bb75f06216dae90674fa1d7fb8c50d8bdf4bd551"
                },
                "name": "fj-b4cf8837b3dfb0576ddcb9be5ae4efd9-deprecated-base-image-check",
                "namespace": "build-e2e-yjiw",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                        "uid": "7bc31381-1a07-4292-b159-a319b4c5753c"
                    }
                ],
                "resourceVersion": "22658",
                "uid": "1b15aaf0-ccb7-4d87-9961-7d1c2ffbef9b"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE_URL",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-test-custom-default-yvxxpm",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "deprecated-image-check"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:22:45Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:22:45Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-b4cf8837b3dfb0576ddcb9becfac491c430dd12dbacac86e7805bdc6-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872"
                        },
                        "entryPoint": "deprecated-image-check",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\", \"digests\": [\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-08-13T08:22:40+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n"
                    }
                ],
                "startTime": "2026-08-13T08:22:19Z",
                "steps": [
                    {
                        "container": "step-check-images",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "check-images",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://3193c5cbb38cc6e009fc00fcb3ee857d7fac5eaf36d41ee29ce3b7c27eed0db0",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:40Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\\\", \\\"digests\\\": [\\\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:40+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:33Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.",
                    "params": [
                        {
                            "default": "/project/repository/",
                            "description": "Path to directory containing Conftest policies.",
                            "name": "POLICY_DIR",
                            "type": "string"
                        },
                        {
                            "default": "required_checks",
                            "description": "Namespace for Conftest policy.",
                            "name": "POLICY_NAMESPACE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Digests of base build images.",
                            "name": "BASE_IMAGES_DIGESTS",
                            "type": "string"
                        },
                        {
                            "description": "Fully qualified image name.",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Image digest.",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "POLICY_DIR",
                                    "value": "/project/repository/"
                                },
                                {
                                    "name": "POLICY_NAMESPACE",
                                    "value": "required_checks"
                                },
                                {
                                    "name": "BASE_IMAGES_DIGESTS"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "check-images",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  while read -r arch arch_sha; do\n    SBOM_FILE_PATH=\"/tmp/sbom-${arch}.json\"\n    arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n    # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n    mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n    export DOCKER_CONFIG=/tmp/auth\n\n    # Get base images from SBOM\n    if ! cosign download sbom \"$arch_imageanddigest\" \u003e \"${SBOM_FILE_PATH}\"; then\n      echo \"Unable to download sbom for arch $arch.\"\n      continue\n    fi\n\n    \u003c \"${SBOM_FILE_PATH}\" jq -r '\n        if .bomFormat == \"CycloneDX\" then\n            .formulation[]?\n            | .components[]?\n            | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n            | (\n                .purl\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        else\n            .packages[]\n            | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n            | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n            | (\n                $purls | first\n                | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n              ) as $matched\n            | $matched.repository_url\n        end\n    ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"Detected base images from $arch SBOM:\"\n    cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n    echo \"\"\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n  echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n  # Get images from the parameter\n  for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n  do\n    echo \"$IMAGE_WITH_TAG\" | cut -d \":\" -f1 \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n  done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n  IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c \"$BASE_IMAGE\"\n\n  # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n  IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n  export IMAGE_REPO_PATH=\"/tmp/${IMAGE_REPOSITORY}\"\n  mkdir -p \"${IMAGE_REPO_PATH}\"\n  echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n  http_code=$(curl -s -o \"${IMAGE_REPO_PATH}/repository_data.json\" -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n  if [ \"$http_code\" == \"200\" ];\n  then\n    echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n    /usr/bin/conftest test --no-fail \"${IMAGE_REPO_PATH}/repository_data.json\" \\\n    --policy \"$POLICY_DIR\" --namespace \"$POLICY_NAMESPACE\" \\\n    --output=json | tee \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\"\n\n    failures_num=$(jq -r '.[].failures|length' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n    if [[ \"${failures_num}\" -gt 0 ]]; then\n      echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n    fi\n    failure_counter=$((failure_counter+failures_num))\n\n    successes_num=$(jq -r '.[].successes' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n    if [[ \"${successes_num}\" -gt 0 ]]; then\n      echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n    fi\n    success_counter=$((success_counter+successes_num))\n\n  elif [ \"$http_code\" == \"404\" ];\n  then\n    echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n    warnings_counter=$((warnings_counter+1))\n  else\n    echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n    error_counter=$((error_counter+1))\n  fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n  if [[ \"${failure_counter}\" -gt 0 ]]; then\n    RES=\"FAILURE\"\n  elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n    RES=\"WARNING\"\n  elif [[ \"${success_counter}\" -eq 0 ]]; then\n    # when all counters are 0, there are no base images to check\n    note=\"Task deprecated-image-check success: No base images to check.\"\n    RES=\"SUCCESS\"\n  else\n    RES=\"SUCCESS\"\n  fi\n  TEST_OUTPUT=$(make_result_json \\\n    -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n    -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/commit_sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "default",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "default",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fjwlxg",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"default\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c/records/19578490-9aa3-4cc2-b91e-e245f99971cc",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-aadpde\",\"commit\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-test-custom-default-yvxxpm"
                },
                "creationTimestamp": "2026-08-13T08:19:43Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-test-application-tewl",
                    "appstudio.openshift.io/component": "fj-test-custom-default-yvxxpm",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                    "tekton.dev/pipelineRunUID": "7bc31381-1a07-4292-b159-a319b4c5753c",
                    "tekton.dev/pipelineTask": "prefetch-dependencies",
                    "tekton.dev/task": "prefetch-dependencies-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "04614a78cb064f85908ed6bb75f06216dae90674fa1d7fb8c50d8bdf4bd551"
                },
                "name": "fj-test-cb4cf8837b3dfb0576ddcb9be5ae4efd9-prefetch-dependencies",
                "namespace": "build-e2e-yjiw",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                        "uid": "7bc31381-1a07-4292-b159-a319b4c5753c"
                    }
                ],
                "resourceVersion": "20769",
                "uid": "19578490-9aa3-4cc2-b91e-e245f99971cc"
            },
            "spec": {
                "params": [
                    {
                        "name": "input",
                        "value": ""
                    },
                    {
                        "name": "enable-package-registry-proxy",
                        "value": "true"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b.prefetch"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "5d"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-test-custom-default-yvxxpm",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "prefetch-dependencies-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3.2@sha256:7f344093a3387d05eeedad1f929743e197212b50ee95ceaebdc74bbe5df05d03"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s",
                "workspaces": [
                    {
                        "name": "git-basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-fjwlxg"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:20:23Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:20:23Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-test-cb4cf8837b3dfb0576d43912871bbee7a1ac09142e61eb80d44-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "7f344093a3387d05eeedad1f929743e197212b50ee95ceaebdc74bbe5df05d03"
                        },
                        "entryPoint": "prefetch-dependencies-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CACHI2_ARTIFACT",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0"
                    }
                ],
                "startTime": "2026-08-13T08:19:43Z",
                "steps": [
                    {
                        "container": "step-skip-ta",
                        "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:1bc3c5c15720506a0cf48adfdf8b623dfe704377e007d7bbae8d14876392ca6a",
                        "name": "skip-ta",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://df054b9b3e22a2f03112016927f4e44754b10754cb2160f82c3727bfd7d8487b",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:19:53Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:19:53Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://e3cd03af2f3289b6e7870aa483482486263d2e165610a444f0bb7e5c7b7ed943",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:19:54Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:19:54Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prefetch-dependencies",
                        "imageID": "quay.io/konflux-ci/hermeto@sha256:27936b01262824104cce87d433ffcb622bf906bc833033b6b05c62257f3c3232",
                        "name": "prefetch-dependencies",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://79d65638de0fd44a42602684c3850bb78b0c2cd9f387fecec9ff0e7487aad650",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:20:22Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:19:55Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://c7080eb452feb842be843e93e15e7bec439af55be50ab8de583378d630a54fe1",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:20:22Z",
                            "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:20:22Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Task that prefetches project dependencies for hermetic build.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": "service-ca.crt",
                            "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "openshift-service-ca.crt",
                            "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.",
                            "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n",
                            "name": "config-file-content",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Use the package registry proxy when prefetching dependencies",
                            "name": "enable-package-registry-proxy",
                            "type": "string"
                        },
                        {
                            "description": "Configures project packages that will have their dependencies prefetched.",
                            "name": "input",
                            "type": "string"
                        },
                        {
                            "default": "debug",
                            "description": "Set the logging level (debug, info, warn, error, fatal).",
                            "name": "log-level",
                            "type": "string"
                        },
                        {
                            "default": "strict",
                            "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).",
                            "name": "mode",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.",
                            "name": "sbom-type",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "64Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "64Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "INPUT"
                                },
                                {
                                    "name": "SOURCE_ARTIFACT",
                                    "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0"
                                }
                            ],
                            "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.8-1781496742@sha256:1bc3c5c15720506a0cf48adfdf8b623dfe704377e007d7bbae8d14876392ca6a",
                            "name": "skip-ta",
                            "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n  mkdir -p /var/workdir/source\n  mkdir -p /var/workdir/cachi2\n  echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n  echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n  echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n  echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n"
                        },
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0=/var/workdir/source"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                            "name": "use-trusted-artifact"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "debug"
                                },
                                {
                                    "name": "KBC_PD_INPUT"
                                },
                                {
                                    "name": "KBC_PD_SOURCE_DIR",
                                    "value": "/var/workdir/source"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR",
                                    "value": "/var/workdir/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_SBOM_FORMAT",
                                    "value": "spdx"
                                },
                                {
                                    "name": "KBC_PD_MODE",
                                    "value": "strict"
                                },
                                {
                                    "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT",
                                    "value": "/cachi2/output"
                                },
                                {
                                    "name": "KBC_PD_ENV_FILES",
                                    "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json"
                                },
                                {
                                    "name": "KBC_PD_GIT_AUTH_DIRECTORY",
                                    "value": "/workspace/git-basic-auth"
                                },
                                {
                                    "name": "WORKSPACE_NETRC_PATH"
                                },
                                {
                                    "name": "CONFIG_FILE_CONTENT"
                                },
                                {
                                    "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY",
                                    "value": "true"
                                }
                            ],
                            "image": "quay.io/konflux-ci/hermeto:0.55.0@sha256:27936b01262824104cce87d433ffcb622bf906bc833033b6b05c62257f3c3232",
                            "name": "prefetch-dependencies",
                            "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n  export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n  cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n  echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n  cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n  UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n  update-ca-trust\n  # requests ignores the system CA store. Set REQUESTS_CA_BUNDLE explicitly.\n  export REQUESTS_CA_BUNDLE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n  export KBC_PD_RHSM_ORG=/activation-key/org\n  export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n  echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n  export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/mnt/config",
                                    "name": "config"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/service-ca",
                                    "name": "service-ca",
                                    "readOnly": true
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b.prefetch",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source",
                                "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "5d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:0d5769f1a100f6b4f330cfa5d2bd22efc50bdb184e270ca84404e25c0b8fcf80",
                            "name": "create-trusted-artifact"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "emptyDir": {},
                            "name": "config"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "service-ca.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "openshift-service-ca.crt",
                                "optional": true
                            },
                            "name": "service-ca"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n",
                            "name": "git-basic-auth",
                            "optional": true
                        },
                        {
                            "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n",
                            "name": "netrc",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/commit_sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "default",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "default",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fjwlxg",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"default\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c/records/369fd49f-7006-42f2-beb2-0db633341691",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-aadpde\",\"commit\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c",
                    "results.tekton.dev/stored": "true",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-test-custom-default-yvxxpm"
                },
                "creationTimestamp": "2026-08-13T08:22:20Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-test-application-tewl",
                    "appstudio.openshift.io/component": "fj-test-custom-default-yvxxpm",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                    "tekton.dev/pipelineRunUID": "7bc31381-1a07-4292-b159-a319b4c5753c",
                    "tekton.dev/pipelineTask": "rpms-signature-scan",
                    "tekton.dev/task": "rpms-signature-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "04614a78cb064f85908ed6bb75f06216dae90674fa1d7fb8c50d8bdf4bd551"
                },
                "name": "fj-test-cusb4cf8837b3dfb0576ddcb9be5ae4efd9-rpms-signature-scan",
                "namespace": "build-e2e-yjiw",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                        "uid": "7bc31381-1a07-4292-b159-a319b4c5753c"
                    }
                ],
                "resourceVersion": "22948",
                "uid": "369fd49f-7006-42f2-beb2-0db633341691"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    },
                    {
                        "name": "image-digest",
                        "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-test-custom-default-yvxxpm",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "rpms-signature-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:ccb77d1bf7627fc6241a59ed42bb6e5707a8682754fe8ae18f2cfdddbcf29275"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:22:57Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:22:57Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-test-cusb4cf8837b3dfb0577f2d962542c23d9680f5eefa8bfcb881-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "ccb77d1bf7627fc6241a59ed42bb6e5707a8682754fe8ae18f2cfdddbcf29275"
                        },
                        "entryPoint": "rpms-signature-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\", \"digests\": [\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\"]}}\n"
                    },
                    {
                        "name": "RPMS_DATA",
                        "type": "string",
                        "value": "{\"keys\": {\"unsigned\": 0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:22:55+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:22:21Z",
                "steps": [
                    {
                        "container": "step-rpms-signature-scan",
                        "imageID": "quay.io/konflux-ci/tools@sha256:816a2ad35037f3233903278371f766102735f96cfaf48a9663ce5b858cec34b3",
                        "name": "rpms-signature-scan",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://06665c2a647f0e8a607cd1277c2b1782dcd4fa721c2a3cfd494e2a7dc5be75c1",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:55Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-output-results",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "output-results",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://45ee0ad80c43e4b2ef2188f10aa2299c7f19324b9de67a6d03ab75a9ffdd38f0",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:55Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\\\", \\\"digests\\\": [\\\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:55+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:55Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans RPMs in an image and provide information about RPMs signatures.",
                    "params": [
                        {
                            "description": "Image URL",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "description": "Image digest to scan",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "/tmp",
                            "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n",
                            "name": "workdir",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Information about signed and unsigned RPMs",
                            "name": "RPMS_DATA",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "200m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                                },
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/tools@sha256:816a2ad35037f3233903278371f766102735f96cfaf48a9663ce5b858cec34b3",
                            "name": "rpms-signature-scan",
                            "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n  --image-url \"${IMAGE_URL}\" \\\n  --image-digest \"${IMAGE_DIGEST}\" \\\n  --workdir \"${WORKDIR}\" \\\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                },
                                "requests": {
                                    "cpu": "50m",
                                    "memory": "32Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "WORKDIR",
                                    "value": "/tmp"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "output-results",
                            "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n  note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n  note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/tmp",
                                    "name": "workdir"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/commit_sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "default",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "default",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fjwlxg",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"default\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c/records/c219b94f-568b-4da0-81fd-1e0a1c9b8d46",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-aadpde\",\"commit\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-test-custom-default-yvxxpm"
                },
                "creationTimestamp": "2026-08-13T08:22:20Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-test-application-tewl",
                    "appstudio.openshift.io/component": "fj-test-custom-default-yvxxpm",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                    "tekton.dev/pipelineRunUID": "7bc31381-1a07-4292-b159-a319b4c5753c",
                    "tekton.dev/pipelineTask": "sast-unicode-check",
                    "tekton.dev/task": "sast-unicode-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "04614a78cb064f85908ed6bb75f06216dae90674fa1d7fb8c50d8bdf4bd551"
                },
                "name": "fj-test-custb4cf8837b3dfb0576ddcb9be5ae4efd9-sast-unicode-check",
                "namespace": "build-e2e-yjiw",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                        "uid": "7bc31381-1a07-4292-b159-a319b4c5753c"
                    }
                ],
                "resourceVersion": "22883",
                "uid": "c219b94f-568b-4da0-81fd-1e0a1c9b8d46"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-test-custom-default-yvxxpm",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-unicode-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min:0.4@sha256:80bf85aebf99a9d26c2d3fae3d90ee6bfe28246e3b0bbd950934ceba764bc067"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:22:53Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:22:53Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-test-custb4cf8837b3dfb05526b1dca93120c7a957cf93e37920094-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "80bf85aebf99a9d26c2d3fae3d90ee6bfe28246e3b0bbd950934ceba764bc067"
                        },
                        "entryPoint": "sast-unicode-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:22:50+00:00\",\"note\":\"Task sast-unicode-check-oci-ta-min success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:22:21Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://60e20fc065b4c83db621fabd999a19a5f56f3de177ac20b17c6a4a835e1d666f",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-unicode-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "sast-unicode-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://78c74b5b05daaa8352b3bcf0d7ad84a960eb89eb91a5b73ce2f77b5c5fee1401",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:50Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:50+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://60a05c2cf95d457f05266d8f16a3cf7fbf026d77b33b1aa5aa1ae404618e30fd",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:53Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:50+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta-min success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:50Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans source code for non-printable unicode characters in all text files.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "-p bidi -v -d -t",
                            "description": "arguments for find-unicode-control command.",
                            "name": "FIND_UNICODE_CONTROL_ARGS",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "description": "Image digest used for ORAS upload.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL used for ORAS upload.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "FIND_UNICODE_CONTROL_ARGS",
                                    "value": "-p bidi -v -d -t"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SOURCE_CODE_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "sast-unicode-check",
                            "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n  ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n  \u003eraw_sast_unicode_check_out.txt \\\n  2\u003eraw_sast_unicode_check_out.log ||\n  FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n  echo \"Failed to run find-unicode-control command\" \u003e\u00262\n  cat raw_sast_unicode_check_out.log\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n  echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n  --mode=json\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"${SCAN_PROP}\"\n  --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n  echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n  cat processed_sast_unicode_check_out.err\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n  mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # Build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  # Append --record-excluded option if RECORD_EXCLUDED is true\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n    mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n  else\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: No finding was detected\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n  note=\"Task sast-unicode-check-oci-ta-min success: Some findings were detected, but filtered by known false positive\"\n  ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n  echo \"sast-unicode-check test failed because of the following issues:\"\n  cat sast_unicode_check_out.json\n  TEST_OUTPUT=\n  parse_test_output \"sast-unicode-check-oci-ta-min\" sarif sast_unicode_check_out.sarif || true\n  note=\"Task sast-unicode-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n  echo 'No image-url param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n    MEDIA_TYPE=application/json\n  else\n    MEDIA_TYPE=application/sarif+json\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/commit_sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "default",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "default",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fjwlxg",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"default\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c/records/2946af0c-b64d-48cf-9d8f-7b0ef2dc17f6",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-aadpde\",\"commit\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-test-custom-default-yvxxpm"
                },
                "creationTimestamp": "2026-08-13T08:22:10Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-test-application-tewl",
                    "appstudio.openshift.io/component": "fj-test-custom-default-yvxxpm",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                    "tekton.dev/pipelineRunUID": "7bc31381-1a07-4292-b159-a319b4c5753c",
                    "tekton.dev/pipelineTask": "build-image-index",
                    "tekton.dev/task": "build-image-index-min",
                    "test.appstudio.openshift.io/pr-group-sha": "04614a78cb064f85908ed6bb75f06216dae90674fa1d7fb8c50d8bdf4bd551"
                },
                "name": "fj-test-custob4cf8837b3dfb0576ddcb9be5ae4efd9-build-image-index",
                "namespace": "build-e2e-yjiw",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                        "uid": "7bc31381-1a07-4292-b159-a319b4c5753c"
                    }
                ],
                "resourceVersion": "22041",
                "uid": "2946af0c-b64d-48cf-9d8f-7b0ef2dc17f6"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    },
                    {
                        "name": "ALWAYS_BUILD_INDEX",
                        "value": "false"
                    },
                    {
                        "name": "IMAGES",
                        "value": [
                            "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                        ]
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-test-custom-default-yvxxpm",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "build-image-index-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3.1@sha256:70679b88f57130e9a939a6765aacd976a9d66bfa5d1733fcee185dc07be39042"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:22:19Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:22:19Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-test-custob4cf8837b3dfb095a7bf4287b11e5c99ae5fdd63bc5def-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "70679b88f57130e9a939a6765aacd976a9d66bfa5d1733fcee185dc07be39042"
                        },
                        "entryPoint": "build-image-index-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                    },
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    }
                ],
                "startTime": "2026-08-13T08:22:10Z",
                "steps": [
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://8f21b8ba7e7d4ba80b78b1ffbbb7b9ed11db3e03e1d226e1d1ece96f2acc494f",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:15Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-sbom",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                        "name": "create-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://1f62871e7f8071d03bc4e2e94ae3360d8c5d554efc9e20503493e7a2428e6287",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:15Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:15Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://eb7a6793017b19b3f546327ce91b057b2ae02141cf0a76e83edd0a5d29a579ff",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:17Z",
                            "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:15Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "This takes existing Image Manifests and combines them in an Image Index.",
                    "params": [
                        {
                            "description": "The target image and tag where the image will be pushed to.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "description": "List of Image Manifests to be referenced by the Image Index",
                            "name": "IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "true",
                            "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.",
                            "name": "ALWAYS_BUILD_INDEX",
                            "type": "string"
                        },
                        {
                            "default": "vfs",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "List of all referenced image manifests",
                            "name": "IMAGES",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image containing both the repository and the digest",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "env": [
                            {
                                "name": "BUILDAH_FORMAT",
                                "value": "docker"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "ALWAYS_BUILD_INDEX",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "vfs"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "false"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/index-build-data",
                                "name": "shared-dir"
                            },
                            {
                                "mountPath": "/mnt/trusted-ca",
                                "name": "trusted-ca",
                                "readOnly": true
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "build",
                            "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n  --image \"$IMAGE\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --buildah-format \"$BUILDAH_FORMAT\" \\\n  --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n  --additional-tags \"fj-test-custob4cf8837b3dfb0576ddcb9be5ae4efd9-build-image-index\" \\\n  --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n  --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n  --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n  --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n  --result-path-images \"/tekton/results/IMAGES\" \\\n  --images \"$@\"; then\n  echo \"Failed to build image index\"\n  exit 1\nfi\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            }
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.1-1782136886@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                            "name": "create-sbom",
                            "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n  echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n  exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-index\n  --index-image-pullspec \"$IMAGE_URL\"\n  --index-image-digest \"$IMAGE_DIGEST\"\n  --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n  echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n  exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n    echo \"Failed to push sbom to registry\"\n    exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "shared-dir"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/commit_sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "default",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "default",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fjwlxg",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"default\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c/records/ab2e94e4-56e6-4c28-b033-2998c94d15d1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-aadpde\",\"commit\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "image-build, konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-test-custom-default-yvxxpm"
                },
                "creationTimestamp": "2026-08-13T08:20:24Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-test-application-tewl",
                    "appstudio.openshift.io/component": "fj-test-custom-default-yvxxpm",
                    "build.appstudio.redhat.com/build_type": "docker",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                    "tekton.dev/pipelineRunUID": "7bc31381-1a07-4292-b159-a319b4c5753c",
                    "tekton.dev/pipelineTask": "build-container",
                    "tekton.dev/task": "buildah-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "04614a78cb064f85908ed6bb75f06216dae90674fa1d7fb8c50d8bdf4bd551"
                },
                "name": "fj-test-custom-b4cf8837b3dfb0576ddcb9be5ae4efd9-build-container",
                "namespace": "build-e2e-yjiw",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                        "uid": "7bc31381-1a07-4292-b159-a319b4c5753c"
                    }
                ],
                "resourceVersion": "21653",
                "uid": "ab2e94e4-56e6-4c28-b033-2998c94d15d1"
            },
            "spec": {
                "params": [
                    {
                        "name": "IMAGE",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    },
                    {
                        "name": "DOCKERFILE",
                        "value": "docker/Dockerfile"
                    },
                    {
                        "name": "CONTEXT",
                        "value": "."
                    },
                    {
                        "name": "HERMETIC",
                        "value": "false"
                    },
                    {
                        "name": "PREFETCH_INPUT",
                        "value": ""
                    },
                    {
                        "name": "IMAGE_EXPIRES_AFTER",
                        "value": "5d"
                    },
                    {
                        "name": "COMMIT_SHA",
                        "value": "2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    },
                    {
                        "name": "BUILD_ARGS",
                        "value": []
                    },
                    {
                        "name": "BUILD_ARGS_FILE",
                        "value": ""
                    },
                    {
                        "name": "PRIVILEGED_NESTED",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_URL",
                        "value": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde"
                    },
                    {
                        "name": "BUILDAH_FORMAT",
                        "value": "docker"
                    },
                    {
                        "name": "HTTP_PROXY",
                        "value": ""
                    },
                    {
                        "name": "NO_PROXY",
                        "value": ""
                    },
                    {
                        "name": "SOURCE_DATE_EPOCH",
                        "value": ""
                    },
                    {
                        "name": "REWRITE_TIMESTAMP",
                        "value": "false"
                    },
                    {
                        "name": "OMIT_HISTORY",
                        "value": "false"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-test-custom-default-yvxxpm",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "buildah-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.10.5@sha256:de644e1dee81463bd47e4e5a33688d4ef40cd963f0a17fccc9cf11ca92eea471"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:22:09Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:22:09Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-test-custom-b4cf8837b3dfb66f065f314ec993348181f86364942f-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "de644e1dee81463bd47e4e5a33688d4ef40cd963f0a17fccc9cf11ca92eea471"
                        },
                        "entryPoint": "buildah-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGE_DIGEST",
                        "type": "string",
                        "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                    },
                    {
                        "name": "IMAGE_REF",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                    },
                    {
                        "name": "IMAGE_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    },
                    {
                        "name": "SBOM_BLOB_URL",
                        "type": "string",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8cebc41c3f51c4723cecdb27dadba79aef7e523545fe562685c734c8b36b3f5f"
                    }
                ],
                "startTime": "2026-08-13T08:20:26Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://1e450ca89ba12d9514329fd77c9d3e2046a044f53d2be852147b2ceb24f68f07",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:20:32Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:20:31Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-build",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "build",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://89b21716db4c4f651df8f2c71464b5a72c3650c62f89773efb3753d514881a55",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:20:43Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:20:33Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-push",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                        "name": "push",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://0e492b1e8ce551d28b71322d04e5f9fd47903b993bd692a1fc2741352c7b9923",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:21:13Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:20:43Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sbom-syft-generate",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "sbom-syft-generate",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://c96a17cac530eca14d9fa9f9f6b1f9fcee9d94f7dc33b8d4f8a129411ce4331a",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:21:25Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:21:13Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-prepare-sboms",
                        "imageID": "quay.io/konflux-ci/mobster@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                        "name": "prepare-sboms",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://ff328cd4902954698408dee8c39e8218209420c02ad2670ba8a9365407aea472",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:21:45Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:21:25Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload-sbom",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                        "name": "upload-sbom",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://6ea0388128ba02956bc491587b701dcc5349c2614878189a996b88ad49f9f7dd",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:08Z",
                            "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b@sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8cebc41c3f51c4723cecdb27dadba79aef7e523545fe562685c734c8b36b3f5f\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:21:45Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.",
                    "params": [
                        {
                            "default": "activation-key",
                            "description": "Name of secret which contains subscription activation key",
                            "name": "ACTIVATION_KEY",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings",
                            "name": "ADDITIONAL_BASE_IMAGES",
                            "type": "array"
                        },
                        {
                            "default": "does-not-exist",
                            "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET",
                            "name": "ADDITIONAL_SECRET",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of extra capabilities to add when running 'buildah build'",
                            "name": "ADD_CAPABILITIES",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Allows to use parent images that don't match the build host architecture. This option must be used with caution as it may create incompatible images.",
                            "name": "ALLOW_CROSS_PLATFORM_IMAGES",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with additional key=value annotations that should be applied to the image",
                            "name": "ANNOTATIONS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "oci",
                            "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.",
                            "name": "BUILDAH_FORMAT",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --build-arg values (\"arg=value\" strings)",
                            "name": "BUILD_ARGS",
                            "type": "array"
                        },
                        {
                            "default": "",
                            "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file",
                            "name": "BUILD_ARGS_FILE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.",
                            "name": "BUILD_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this commit.",
                            "name": "COMMIT_SHA",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Path to the directory to use as context.",
                            "name": "CONTEXT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if SBOM will be contextualized.",
                            "name": "CONTEXTUALIZE_SBOM",
                            "type": "string"
                        },
                        {
                            "default": "./Dockerfile",
                            "description": "Path to the Dockerfile to build.",
                            "name": "DOCKERFILE",
                            "type": "string"
                        },
                        {
                            "default": "etc-pki-entitlement",
                            "description": "Name of secret which contains the entitlement certificates",
                            "name": "ENTITLEMENT_SECRET",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Array of --env values (\"env=value\" strings)",
                            "name": "ENV_VARS",
                            "type": "array"
                        },
                        {
                            "default": "false",
                            "description": "Determines if build will be executed without network access.",
                            "name": "HERMETIC",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.",
                            "name": "HTTP_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection",
                            "name": "ICM_KEEP_COMPAT_LOCATION",
                            "type": "string"
                        },
                        {
                            "description": "Reference of the image buildah will produce.",
                            "name": "IMAGE",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.",
                            "name": "IMAGE_EXPIRES_AFTER",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Determines if the image inherits the base image labels.",
                            "name": "INHERIT_BASE_IMAGE_LABELS",
                            "type": "string"
                        },
                        {
                            "default": [],
                            "description": "Additional key=value labels that should be applied to the image",
                            "name": "LABELS",
                            "type": "array"
                        },
                        {
                            "default": "info",
                            "description": "Log level for the build command.",
                            "name": "LOG_LEVEL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.",
                            "name": "NO_PROXY",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.",
                            "name": "OMIT_HISTORY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "In case it is not empty, the prefetched content should be made available to the build.",
                            "name": "PREFETCH_INPUT",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to enable privileged mode, should be used only with remote VMs",
                            "name": "PRIVILEGED_NESTED",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY",
                            "type": "string"
                        },
                        {
                            "default": "caching-ca-bundle",
                            "description": "The name of the ConfigMap to read proxy CA bundle data from.",
                            "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.",
                            "name": "REWRITE_TIMESTAMP",
                            "type": "string"
                        },
                        {
                            "default": "auto",
                            "description": "Mount /etc/rhsm/ca from the host machine into the build. Valid values are 'always', 'auto' (default), 'never'. Only effective if HERMETIC=false and ACTIVATION_KEY or ENTITLEMENT_SECRET is set.",
                            "name": "RHSM_MOUNT_CA_CERTS",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.",
                            "name": "SBOM_SKIP_VALIDATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.",
                            "name": "SBOM_SOURCE_SCAN_ENABLED",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection",
                            "name": "SBOM_SYFT_SELECT_CATALOGERS",
                            "type": "string"
                        },
                        {
                            "default": "spdx",
                            "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.",
                            "name": "SBOM_TYPE",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.",
                            "name": "SKIP_INJECTIONS",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled",
                            "name": "SKIP_SBOM_GENERATION",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages",
                            "name": "SKIP_UNUSED_STAGES",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.",
                            "name": "SOURCE_DATE_EPOCH",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The image is built from this URL.",
                            "name": "SOURCE_URL",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Squash all new and previous layers added as a part of this build, as per --squash",
                            "name": "SQUASH",
                            "type": "string"
                        },
                        {
                            "default": "overlay",
                            "description": "Storage driver to configure for buildah",
                            "name": "STORAGE_DRIVER",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.",
                            "name": "TARGET_STAGE",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)",
                            "name": "TLSVERIFY",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).",
                            "name": "WORKINGDIR_MOUNT",
                            "type": "string"
                        },
                        {
                            "default": "fetched.repos.d",
                            "description": "Path in source workspace where dynamically-fetched repos are present",
                            "name": "YUM_REPOS_D_FETCHED",
                            "type": "string"
                        },
                        {
                            "default": "repos.d",
                            "description": "Path in the git repository in which yum repository files are stored",
                            "name": "YUM_REPOS_D_SRC",
                            "type": "string"
                        },
                        {
                            "default": "/etc/yum.repos.d",
                            "description": "Target path on the container in which yum repository files should be made available",
                            "name": "YUM_REPOS_D_TARGET",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Digest of the image just built",
                            "name": "IMAGE_DIGEST",
                            "type": "string"
                        },
                        {
                            "description": "Image reference of the built image",
                            "name": "IMAGE_REF",
                            "type": "string"
                        },
                        {
                            "description": "Image repository and tag where the built image was pushed",
                            "name": "IMAGE_URL",
                            "type": "string"
                        },
                        {
                            "description": "Reference of SBOM blob digest to enable digest-based verification from provenance",
                            "name": "SBOM_BLOB_URL",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {
                            "limits": {
                                "memory": "256Mi"
                            },
                            "requests": {
                                "cpu": "100m",
                                "memory": "256Mi"
                            }
                        },
                        "env": [
                            {
                                "name": "ADDITIONAL_SECRET",
                                "value": "does-not-exist"
                            },
                            {
                                "name": "ADD_CAPABILITIES"
                            },
                            {
                                "name": "ALLOW_CROSS_PLATFORM_IMAGES",
                                "value": "false"
                            },
                            {
                                "name": "ANNOTATIONS_FILE"
                            },
                            {
                                "name": "BUILD_ARGS_FILE"
                            },
                            {
                                "name": "BUILD_TIMESTAMP"
                            },
                            {
                                "name": "CONTEXT",
                                "value": "."
                            },
                            {
                                "name": "CONTEXTUALIZE_SBOM",
                                "value": "true"
                            },
                            {
                                "name": "HERMETIC",
                                "value": "false"
                            },
                            {
                                "name": "IMAGE",
                                "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                            },
                            {
                                "name": "IMAGE_EXPIRES_AFTER",
                                "value": "5d"
                            },
                            {
                                "name": "INHERIT_BASE_IMAGE_LABELS",
                                "value": "true"
                            },
                            {
                                "name": "KBC_LOG_LEVEL",
                                "value": "info"
                            },
                            {
                                "name": "PRIVILEGED_NESTED",
                                "value": "false"
                            },
                            {
                                "name": "RHSM_MOUNT_CA_CERTS",
                                "value": "auto"
                            },
                            {
                                "name": "SBOM_SKIP_VALIDATION",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SOURCE_SCAN_ENABLED",
                                "value": "true"
                            },
                            {
                                "name": "SBOM_SYFT_SELECT_CATALOGERS"
                            },
                            {
                                "name": "SBOM_TYPE",
                                "value": "spdx"
                            },
                            {
                                "name": "SKIP_INJECTIONS",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_SBOM_GENERATION",
                                "value": "false"
                            },
                            {
                                "name": "SKIP_UNUSED_STAGES",
                                "value": "true"
                            },
                            {
                                "name": "SOURCE_CODE_DIR",
                                "value": "source"
                            },
                            {
                                "name": "SQUASH",
                                "value": "false"
                            },
                            {
                                "name": "STORAGE_DRIVER",
                                "value": "overlay"
                            },
                            {
                                "name": "TARGET_STAGE"
                            },
                            {
                                "name": "TLSVERIFY",
                                "value": "true"
                            },
                            {
                                "name": "WORKINGDIR_MOUNT"
                            },
                            {
                                "name": "YUM_REPOS_D_FETCHED",
                                "value": "fetched.repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_SRC",
                                "value": "repos.d"
                            },
                            {
                                "name": "YUM_REPOS_D_TARGET",
                                "value": "/etc/yum.repos.d"
                            }
                        ],
                        "imagePullPolicy": "IfNotPresent",
                        "volumeMounts": [
                            {
                                "mountPath": "/shared",
                                "name": "shared"
                            },
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "args": [
                                "--build-args",
                                "--envs",
                                "--labels",
                                "--annotations"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                },
                                "requests": {
                                    "cpu": "500m",
                                    "memory": "1Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "COMMIT_SHA",
                                    "value": "2f5b237f399a1da39af4d15fc7049242c0a4948b"
                                },
                                {
                                    "name": "SOURCE_URL",
                                    "value": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde"
                                },
                                {
                                    "name": "DOCKERFILE",
                                    "value": "docker/Dockerfile"
                                },
                                {
                                    "name": "BUILDAH_HTTP_PROXY"
                                },
                                {
                                    "name": "BUILDAH_NO_PROXY"
                                },
                                {
                                    "name": "ICM_KEEP_COMPAT_LOCATION",
                                    "value": "true"
                                },
                                {
                                    "name": "BUILDAH_OMIT_HISTORY",
                                    "value": "false"
                                },
                                {
                                    "name": "BUILDAH_SOURCE_DATE_EPOCH"
                                },
                                {
                                    "name": "BUILDAH_REWRITE_TIMESTAMP",
                                    "value": "false"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "build",
                            "script": "#!/bin/bash\nset -euo pipefail\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n  echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n  cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n  update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n  echo \"[$(date --utc -Ins)] Update CA trust\"\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Delete policy settings for Red Hat registries to disable signature verification.\n# TODO: don't do this?\ncontainer_policy=$(\n  jq '.transports |= (\n        del(.docker.[\"registry.access.redhat.com\"]) |\n        del(.docker.[\"registry.redhat.io\"]) |\n        if (.docker == {}) then del(.docker) else . end\n      )' /etc/containers/policy.json\n)\necho \"Effective container policy:\"\nprintf '%s\\n' \"$container_policy\" | tee /etc/containers/policy.json\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\necho \"[$(date --utc -Ins)] Run the build\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n  dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelse\n  echo \"Cannot find Dockerfile $DOCKERFILE\"\n  exit 1\nfi\n\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n  ANNOTATIONS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\")\nfi\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n  BUILD_ARGS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nsecurity_args=(--security-opts unmask=/proc/interrupts)\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n  security_args+=(--security-opts label=disable)\n  security_args+=(--cap-add all)\n  security_args+=(--devices /dev/fuse)\nfi\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n  security_args+=(--cap-add \"${ADD_CAPABILITIES}\")\nfi\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n  prefetch_dir=\"/var/workdir/cachi2\"\n  # KBC defaults to ${prefetch_dir}/copy-*\n  # Copy to a sibling dir instead in case we don't have write permissions to the prefetch_dir.\n  # It's still on the same filesystem, so copying via reflinks should be possible.\n  prefetch_dir_copy=\"/var/workdir/prefetch-copy\"\nelse\n  prefetch_dir=\"\"\n  prefetch_dir_copy=\"\"\nfi\n\nyum_repos_d_sources=()\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n  yum_repos_d_sources+=(\"${YUM_REPOS_D_FETCHED}\")\nfi\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n  yum_repos_d_sources+=(\"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\")\nfi\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 4. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n#    to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n#    to \"/etc/pki/entitlement\" to prevent certificates from being included\nrhsm_args=()\nif [ \"${HERMETIC}\" != \"true\" ]; then\n  if [ -e /activation-key/org ]; then\n    rhsm_args+=(--rhsm-activation-key=/activation-key/activationkey\n      --rhsm-org=/activation-key/org\n      --rhsm-activation-mount=/activation-key)\n\n    if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n      # user is not running registration in the Containerfile: pre-register.\n      rhsm_args+=(--rhsm-activation-preregister)\n    fi\n  elif find /entitlement -name \"*.pem\" \u003e/dev/null; then\n    rhsm_args+=(--rhsm-entitlements=/entitlement)\n  fi\nfi\nif [ \"${RHSM_MOUNT_CA_CERTS}\" != \"auto\" ]; then\n  rhsm_args+=(--rhsm-mount-ca-certs=\"$RHSM_MOUNT_CA_CERTS\")\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\ncmd=(\n  konflux-build-cli image build\n  -f \"$dockerfile_path\" -t \"$IMAGE\" --source \"$SOURCE_CODE_DIR\" --context \"$CONTEXT\"\n  --secret-dirs \"src=/additional-secret,name=$ADDITIONAL_SECRET,optional=true\"\n  --workdir-mount \"$WORKINGDIR_MOUNT\"\n  --target \"$TARGET_STAGE\"\n  --inherit-labels=\"$INHERIT_BASE_IMAGE_LABELS\"\n  --source-date-epoch \"$BUILDAH_SOURCE_DATE_EPOCH\"\n  --rewrite-timestamp=\"$BUILDAH_REWRITE_TIMESTAMP\"\n  --squash=\"$SQUASH\"\n  --omit-history=\"$BUILDAH_OMIT_HISTORY\"\n  --image-source \"$SOURCE_URL\"\n  --image-revision \"$COMMIT_SHA\"\n  --quay-image-expires-after \"$IMAGE_EXPIRES_AFTER\"\n  --build-args-file \"$BUILD_ARGS_FILE\"\n  --annotations-file \"$ANNOTATIONS_FILE\"\n  --legacy-build-timestamp \"$BUILD_TIMESTAMP\"\n  --add-legacy-labels\n  --include-legacy-buildinfo-path=\"$ICM_KEEP_COMPAT_LOCATION\"\n  --skip-injections=\"$SKIP_INJECTIONS\"\n  --skip-unused-stages=\"$SKIP_UNUSED_STAGES\"\n  --hermetic=\"$HERMETIC\"\n  --image-pull-proxy \"$BUILDAH_HTTP_PROXY\"\n  --image-pull-noproxy \"$BUILDAH_NO_PROXY\"\n  --yum-repos-d-sources \"${yum_repos_d_sources[@]}\"\n  --yum-repos-d-target \"$YUM_REPOS_D_TARGET\"\n  --prefetch-dir \"$prefetch_dir\"\n  --prefetch-dir-copy \"$prefetch_dir_copy\"\n  --prefetch-env-mount /cachi2/cachi2.env\n  --prefetch-output-mount /cachi2/output\n  \"${security_args[@]}\"\n  \"${rhsm_args[@]}\"\n  --containerfile-json-output /shared/parsed_dockerfile.json\n  --resolved-base-images-output /shared/base_images_digests\n  --no-cache\n  --ulimits nofile=4096:4096\n  --src-tls-verify=\"$TLSVERIFY\"\n  --dest-tls-verify=\"$TLSVERIFY\"\n  --allow-cross-platform-images=\"$ALLOW_CROSS_PLATFORM_IMAGES\"\n  \"$@\" # --annotations, --labels, --envs, --build-args\n)\n\necho \"[$(date --utc -Ins)] $(printf '%q ' \"${cmd[@]}\")\"\n\n\"${cmd[@]}\"\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"${prefetch_dir}/output/bom.json\" ]; then\n  echo \"Making copy of sbom-prefetch.json\"\n  cp \"${prefetch_dir}/output/bom.json\" ./sbom-prefetch.json\nfi\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/entitlement",
                                    "name": "etc-pki-entitlement"
                                },
                                {
                                    "mountPath": "/activation-key",
                                    "name": "activation-key"
                                },
                                {
                                    "mountPath": "/additional-secret",
                                    "name": "additional-secret"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/mnt/proxy-ca-bundle",
                                    "name": "proxy-ca-bundle",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/root"
                                },
                                {
                                    "name": "BUILDAH_FORMAT",
                                    "value": "docker"
                                },
                                {
                                    "name": "TASKRUN_NAME",
                                    "value": "fj-test-custom-b4cf8837b3dfb0576ddcb9be5ae4efd9-build-container"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54",
                            "name": "push",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n  push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  \"$IMAGE\" \\\n  \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n  echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n  --format=\"$push_format\" \\\n  --retry \"$buildah_retries\" \\\n  --tls-verify=\"$TLSVERIFY\" \\\n  --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n  \"docker://$IMAGE\"; then\n  echo \"Failed to push image to $IMAGE\"\n  exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee \"/tekton/results/IMAGE_URL\"\n{\n  echo -n \"${IMAGE}@\"\n  cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n  echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n  SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n   [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n   [rekorInternalUrl]=REKOR_URL\n   [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n   [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n   [rekorInternalUrl]=rekorExternalUrl\n   [fulcioInternalUrl]=fulcioExternalUrl\n   [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n  val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n  if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n    fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n    val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n    if [ -n \"${val}\" ]; then\n      echo \"Using fallback ${fallback_key} instead of ${key}\"\n    fi\n  fi\n  if [ -z \"${val}\" ]; then\n    missing=\"${missing:+${missing}, }${key}\"\n  else\n    declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n    configured=$((configured + 1))\n  fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n  echo \"Keyless signing is enabled\"\n\n  # Save signing config for upload-sbom step\n  for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n    envvar=\"${SIGNING_KEY_MAP[$key]}\"\n    printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n  done \u003e/shared/signing-config.env\n\n  echo \"Using Rekor URL: ${REKOR_URL}\"\n  echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n  echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  echo \"[$(date --utc -Ins)] Sign image\"\n  echo \"Signing image ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign sign -y \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign image\" \u003e\u00262\n    exit 1\n  fi\nelif [ \"${configured}\" -eq 0 ]; then\n  echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n  echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n  exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                },
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "256m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "sbom-syft-generate",
                            "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n  syft_sbom_type=cyclonedx-json@1.5\n  ;;\nspdx)\n  syft_sbom_type=spdx-json@2.3\n  ;;\n*)\n  echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n  exit 1\n  ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n  oci-dir:\"${OCI_DIR}\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n  dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n  --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n  syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n  syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n  echo \"Running syft on the source code\"\n  syft \"${syft_source_args[@]}\"\nelse\n  echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/lib/containers",
                                    "name": "varlibcontainers"
                                },
                                {
                                    "mountPath": "/shared",
                                    "name": "shared"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "args": [
                                "--additional-base-images"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/mobster:1.2.1-1782136886@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15",
                            "name": "prepare-sboms",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n  case $1 in\n  --additional-base-images)\n    shift\n    while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n      ADDITIONAL_BASE_IMAGES+=(\"$1\")\n      shift\n    done\n    ;;\n  *)\n    echo \"unexpected argument: $1\" \u003e\u00262\n    exit 2\n    ;;\n  esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n  generate\n  --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n  echo \"Skipping SBOM validation\"\n  mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n  oci-image\n  --from-syft \"/var/workdir/sbom-image.json\"\n  --image-pullspec \"$IMAGE_URL\"\n  --image-digest \"$IMAGE_DIGEST\"\n  --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n  --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n  mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n  mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n  mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n  mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n  mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n  mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "workingDir": "/var/workdir"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "512Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b",
                            "name": "upload-sbom",
                            "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n  echo \"Skipping SBOM generation\"\n  exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n  echo \"Failed to push sbom to registry\"\n  exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n  # shellcheck source=/dev/null\n  source /shared/signing-config.env\n\n  echo \"Initializing TUF root from ${TUF_URL}\"\n  if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n    echo \"Failed to initialize TUF root\" \u003e\u00262\n    exit 1\n  fi\n\n  # env var consumed by cosign\n  SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n  export SIGSTORE_ID_TOKEN\n\n  IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n  ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n  if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n    # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n    # spdx export data as rawstring, we want structured json as cyclonedx\n    ATT_SBOM_TYPE=\"spdxjson\"\n  fi\n\n  echo \"[$(date --utc -Ins)] Sign SBOM\"\n  echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n  if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n    --rekor-url=\"${REKOR_URL}\" \\\n    --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n    --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n    \"${IMAGE_REF}\"; then\n    echo \"Failed to sign SBOM\" \u003e\u00262\n    exit 1\n  fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n",
                            "securityContext": {
                                "runAsNonRoot": false,
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/run/sigstore/cosign",
                                    "name": "oidc-token",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir"
                        }
                    ],
                    "volumes": [
                        {
                            "name": "activation-key",
                            "secret": {
                                "optional": true,
                                "secretName": "activation-key"
                            }
                        },
                        {
                            "name": "additional-secret",
                            "secret": {
                                "optional": true,
                                "secretName": "does-not-exist"
                            }
                        },
                        {
                            "name": "etc-pki-entitlement",
                            "secret": {
                                "optional": true,
                                "secretName": "etc-pki-entitlement"
                            }
                        },
                        {
                            "name": "oidc-token",
                            "projected": {
                                "sources": [
                                    {
                                        "serviceAccountToken": {
                                            "audience": "sigstore",
                                            "expirationSeconds": 600,
                                            "path": "oidc-token"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "caching-ca-bundle",
                                "optional": true
                            },
                            "name": "proxy-ca-bundle"
                        },
                        {
                            "emptyDir": {},
                            "name": "shared"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "varlibcontainers"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/commit_sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "default",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "default",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fjwlxg",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"default\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c/records/34f8b17c-6a99-409d-9d5a-9b10f5cb494c",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-aadpde\",\"commit\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "virus, konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-test-custom-default-yvxxpm"
                },
                "creationTimestamp": "2026-08-13T08:22:20Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-test-application-tewl",
                    "appstudio.openshift.io/component": "fj-test-custom-default-yvxxpm",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                    "tekton.dev/pipelineRunUID": "7bc31381-1a07-4292-b159-a319b4c5753c",
                    "tekton.dev/pipelineTask": "clamav-scan",
                    "tekton.dev/task": "clamav-scan-min",
                    "test.appstudio.openshift.io/pr-group-sha": "04614a78cb064f85908ed6bb75f06216dae90674fa1d7fb8c50d8bdf4bd551"
                },
                "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p-clamav-scan",
                "namespace": "build-e2e-yjiw",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                        "uid": "7bc31381-1a07-4292-b159-a319b4c5753c"
                    }
                ],
                "resourceVersion": "23511",
                "uid": "34f8b17c-6a99-409d-9d5a-9b10f5cb494c"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-test-custom-default-yvxxpm",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "clamav-scan-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:9f7f5ca49400455e48ab2a1cce4759c7aab43c9a09e2a81714c8039efea5c811"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:23:31Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:23:31Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-test-custom-default-yvxxeedec43b83e085f14806108e3d413d62-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "9f7f5ca49400455e48ab2a1cce4759c7aab43c9a09e2a81714c8039efea5c811"
                        },
                        "entryPoint": "clamav-scan-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\", \"digests\": [\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\"]}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"timestamp\":\"1786609408\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n"
                    }
                ],
                "startTime": "2026-08-13T08:22:20Z",
                "steps": [
                    {
                        "container": "step-extract-and-scan-image",
                        "imageID": "quay.io/konflux-ci/clamav-db@sha256:dbe5e223cf38ee7d6ab01cafa1593605f31f6a204fad0afd9ffe5ac8650222d5",
                        "name": "extract-and-scan-image",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://c67f24f1e4576144b9b65b29e7f8819f71028175129f8b4fe273c8bc522d7a09",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:23:28Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\\\", \\\"digests\\\": [\\\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786609408\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5cf2a02d8d7e4aaf200f003ac3fd0406f65c93707fc561095d04d469cec9ff02",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:23:31Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\\\", \\\"digests\\\": [\\\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786609408\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:23:28Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image arch.",
                            "name": "image-arch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "unused",
                            "name": "docker-auth",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "8",
                            "description": "Maximum number of threads clamd runs.",
                            "name": "clamd-max-threads",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-upload",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                },
                                "requests": {
                                    "cpu": "512m",
                                    "memory": "3Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "HOME",
                                    "value": "/work"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                                },
                                {
                                    "name": "IMAGE_ARCH"
                                },
                                {
                                    "name": "MAX_THREADS",
                                    "value": "8"
                                }
                            ],
                            "image": "quay.io/konflux-ci/clamav-db:latest",
                            "name": "extract-and-scan-image",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n    mkdir -p ~/.docker\n    echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n    echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n    exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n#   $1: destination - path to the content to scan\n#   $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n#   $3: digest - digest to add to digests_processed array\n#   $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n  local destination=\"$1\"\n  local suffix=\"$2\"\n  local digest=\"$3\"\n  local scan_message=\"${4:-Scanning content}\"\n\n  db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n  echo \"$scan_message. This operation may take a while.\"\n  clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n    | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n  echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n  digests_processed+=(\"\\\"$digest\\\"\")\n\n  if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n    # OPA/EC requires structured data input, add clamAV log into json\n    jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o json \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n    # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n    EC_EXPERIMENTAL=1 ec test \\\n      --namespace required_checks \\\n      --policy /project/clamav/virus-check.rego \\\n      -o appstudio \\\n      \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n    cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n  fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n  echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n  raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n\n  if [ -n \"$raw_manifest\" ]; then\n    media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n    artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n    config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n    # Determine if this is an OCI artifact (not a container image)\n    # OCI artifacts typically have:\n    # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n    # - An explicit artifactType field that is not a container image type\n    is_oci_artifact=false\n\n    # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n    if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n      is_oci_artifact=true\n    fi\n\n    # Check if artifactType is set and is not a container image type\n    if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n      is_oci_artifact=true\n    fi\n\n    if [ \"$is_oci_artifact\" = true ]; then\n      # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n      echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n      # This looks like a container image manifest, but get_image_manifests failed\n      echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n      ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n      echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n      exit 0\n    else\n      # Likely an OCI artifact with non-standard media type\n      echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n      if [ -s /work/logs/artifact-meta.json ]; then\n        tmp=$(mktemp)\n        if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n          mv \"$tmp\" /work/logs/artifact-meta.json || true\n        fi\n      fi\n      destination=\"content-oci\"\n      mkdir -p \"$destination\"\n\n      # Download OCI artifact using skopeo copy\n      echo \"Downloading OCI artifact using skopeo copy\"\n      if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n        echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n        note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n        ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n        echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n        exit 0\n      fi\n\n      # Scan and process OCI artifact\n      scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n      # Skip the container image processing path\n      image_manifests=\"\"\n    fi\n  else\n    echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n    note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n    ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n    echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n    exit 0\n  fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n  echo \"Detected container image. Processing image manifests.\"\n  if [ -s /work/logs/artifact-meta.json ]; then\n    tmp=$(mktemp)\n    if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n      mv \"$tmp\" /work/logs/artifact-meta.json || true\n    fi\n  fi\n  # Proceed only if a specific arch is provided.\n  # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n  if [ -n \"$IMAGE_ARCH\" ]; then\n    arch=\"${IMAGE_ARCH#*/}\"\n    if [ \"${arch}\" = \"x86_64\" ]; then\n      arch=\"amd64\"\n    fi\n\n    # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n    # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n    case \"$arch\" in\n      amd64|ppc64le|arm64|s390x)\n        ;;\n      *)\n        arch=\"amd64\"\n        ;;\n    esac\n\n    image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n  fi\n\n  while read -r arch arch_sha; do\n    destination=\"content-${arch}\"\n    mkdir -p \"$destination\"\n    arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n    echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n    if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n      echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n      exit 0\n    fi\n\n    # Scan and process container image for this architecture\n    scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n  done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n  reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n    {\n    \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n    \"namespace\" : $item.namespace,\n    \"successes\" : (.successes + $item.successes),\n    \"failures\" : (.failures + $item.failures),\n    \"warnings\" : (.warnings + $item.warnings),\n    \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n    \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n    })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_UPLOAD",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:2.1.0@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n  echo \"Upload skipped by parameter.\"\n  exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n  MEDIA_TYPE=text/vnd.clamav\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n  MEDIA_TYPE=application/vnd.konflux.test_output+json\n  args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n  echo \"No files found. Skipping upload.\"\n  exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/work",
                                    "name": "work"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/work"
                        }
                    ],
                    "volumes": [
                        {
                            "emptyDir": {},
                            "name": "dbfolder"
                        },
                        {
                            "emptyDir": {},
                            "name": "work"
                        },
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/commit_sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "default",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "default",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fjwlxg",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"default\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c/records/d6a54420-fd9e-49aa-bc85-3f16b6b6bdd4",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-aadpde\",\"commit\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-test-custom-default-yvxxpm"
                },
                "creationTimestamp": "2026-08-13T08:19:01Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-test-application-tewl",
                    "appstudio.openshift.io/component": "fj-test-custom-default-yvxxpm",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                    "tekton.dev/pipelineRunUID": "7bc31381-1a07-4292-b159-a319b4c5753c",
                    "tekton.dev/pipelineTask": "init",
                    "tekton.dev/task": "init",
                    "test.appstudio.openshift.io/pr-group-sha": "04614a78cb064f85908ed6bb75f06216dae90674fa1d7fb8c50d8bdf4bd551"
                },
                "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p-init",
                "namespace": "build-e2e-yjiw",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                        "uid": "7bc31381-1a07-4292-b159-a319b4c5753c"
                    }
                ],
                "resourceVersion": "19739",
                "uid": "d6a54420-fd9e-49aa-bc85-3f16b6b6bdd4"
            },
            "spec": {
                "params": [
                    {
                        "name": "enable-cache-proxy",
                        "value": "false"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-test-custom-default-yvxxpm",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "init"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:19:24Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:19:24Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p-init-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db"
                        },
                        "entryPoint": "init",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-init"
                    }
                },
                "results": [
                    {
                        "name": "http-proxy",
                        "type": "string",
                        "value": ""
                    },
                    {
                        "name": "no-proxy",
                        "type": "string",
                        "value": ""
                    }
                ],
                "startTime": "2026-08-13T08:19:01Z",
                "steps": [
                    {
                        "container": "step-init",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                        "name": "init",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://5df8aa33d7a808807f3bf5aeadffc6c9cf1c961a83aa94511fc6c0a774b98aa1",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:19:22Z",
                            "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:19:20Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.",
                    "params": [
                        {
                            "default": "false",
                            "description": "Enable cache proxy configuration",
                            "name": "enable-cache-proxy",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)",
                            "name": "http-proxy",
                            "type": "string"
                        },
                        {
                            "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)",
                            "name": "no-proxy",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "args": [
                                "--enable",
                                "false"
                            ],
                            "command": [
                                "konflux-build-cli",
                                "config",
                                "cache-proxy"
                            ],
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "DEFAULT_HTTP_PROXY",
                                    "value": "squid.caching.svc.cluster.local:3128"
                                },
                                {
                                    "name": "DEFAULT_NO_PROXY",
                                    "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
                                },
                                {
                                    "name": "HTTP_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/http-proxy"
                                },
                                {
                                    "name": "NO_PROXY_RESULTS_PATH",
                                    "value": "/tekton/results/no-proxy"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae",
                            "name": "init"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/commit_sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "default",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "default",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fjwlxg",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"default\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c/records/3ecc7fa0-1e73-40c0-8404-e3d2b61ee4ea",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-aadpde\",\"commit\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-test-custom-default-yvxxpm"
                },
                "creationTimestamp": "2026-08-13T08:22:20Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-test-application-tewl",
                    "appstudio.openshift.io/component": "fj-test-custom-default-yvxxpm",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                    "tekton.dev/pipelineRunUID": "7bc31381-1a07-4292-b159-a319b4c5753c",
                    "tekton.dev/pipelineTask": "tpa-scan",
                    "tekton.dev/task": "tpa-scan",
                    "test.appstudio.openshift.io/pr-group-sha": "04614a78cb064f85908ed6bb75f06216dae90674fa1d7fb8c50d8bdf4bd551"
                },
                "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p-tpa-scan",
                "namespace": "build-e2e-yjiw",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                        "uid": "7bc31381-1a07-4292-b159-a319b4c5753c"
                    }
                ],
                "resourceVersion": "22958",
                "uid": "3ecc7fa0-1e73-40c0-8404-e3d2b61ee4ea"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-test-custom-default-yvxxpm",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "tpa-scan"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:6a204cecc1a1091bf928b3db5a4082735c2111f90befdb5b043c498833c02bcf"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:22:57Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:22:57Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-test-custom-default-yvxx5e3e8631cb7360128f150b90aca35b0b-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "6a204cecc1a1091bf928b3db5a4082735c2111f90befdb5b043c498833c02bcf"
                        },
                        "entryPoint": "tpa-scan",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan"
                    }
                },
                "results": [
                    {
                        "name": "IMAGES_PROCESSED",
                        "type": "string",
                        "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\", \"digests\": [\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\"]}}\n"
                    },
                    {
                        "name": "REPORTS",
                        "type": "string",
                        "value": "{\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\":\"sha256:0d2c3d4acb237dcbfd22dc68fa129852f82772da1f25c4bbef8ede1f962061ab\"}\n"
                    },
                    {
                        "name": "SCAN_OUTPUT",
                        "type": "string",
                        "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n"
                    },
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:22:55+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:22:22Z",
                "steps": [
                    {
                        "container": "step-get-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "get-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://2189509ea4e7d82c3cc84d8ac7fb0a6ae24e4ec750f97f6cc8c474afe3649424",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:51Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:47Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-oci-attach-report",
                        "imageID": "quay.io/konflux-ci/task-runner@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                        "name": "oci-attach-report",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://de4fb8e4abc226e6ee734ffd5435f05f93e25f0c5264424623fac6cf5f5dba1e",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:55Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:52Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-conftest-vulnerabilities",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "conftest-vulnerabilities",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://0dd77b0816ceddb23619f7a02610f90cba7dccec3cb08288fe545165b51448a8",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:55Z",
                            "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b\\\", \\\"digests\\\": [\\\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711\\\":\\\"sha256:0d2c3d4acb237dcbfd22dc68fa129852f82772da1f25c4bbef8ede1f962061ab\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:55+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:55Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.",
                    "params": [
                        {
                            "description": "Image digest to scan.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "The platform which will be scanned by this task.",
                            "name": "image-platform",
                            "type": "string"
                        },
                        {
                            "default": "https://exhort.stage.devshift.net/api/v5/analysis",
                            "description": "The url of the TPA instance which will be used for scanning.",
                            "name": "tpa-url",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "ca-trust-config-map-name",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "ca-trust-config-map-key",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.",
                            "name": "skip-oci-attach-report",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "TPA scan result.",
                            "name": "SCAN_OUTPUT",
                            "type": "string"
                        },
                        {
                            "description": "Images processed in the task.",
                            "name": "IMAGES_PROCESSED",
                            "type": "string"
                        },
                        {
                            "description": "Mapping of image digests to report digests",
                            "name": "REPORTS",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                "name": "trusted-ca",
                                "readOnly": true,
                                "subPath": "ca-bundle.crt"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                },
                                "requests": {
                                    "cpu": "800m",
                                    "memory": "2Gi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                                },
                                {
                                    "name": "IMAGE_PLATFORM"
                                },
                                {
                                    "name": "TPA_URL",
                                    "value": "https://exhort.stage.devshift.net/api/v5/analysis"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "imagePullPolicy": "Always",
                            "name": "get-vulnerabilities",
                            "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n  echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n    echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n  done\nelse\n  echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n  note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 0\nfi\n\n\ntpa_scan() {\n  local sbom_file=${1}\n  local arch=${2}\n  local sbom_format\n\n  sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n  retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee  \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n  local arch=\"$1\"\n  local sha_file=\"image-manifest-${arch}.sha\"\n  local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n  local arch_sha=\"\"\n\n  if [ -e \"${sha_file}\" ]; then\n    arch_sha=$(\u003c\"${sha_file}\")\n    arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n  else\n    echo \"Couldn't find the SHA file for the requested architecture.\"\n    exit 1\n  fi\n\n  echo \"Selecting auth\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n\n  # Attempt to download the SBOM file via cosign\n\n  if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n    echo \"Unable to download SBOM for the architecture ${arch}.\"\n    exit 1\n  fi\n\n  if [ -e \"${sbom_file_path}\" ]; then\n    local arch_sha\n    arch_sha=$(\u003c\"$sha_file\")\n\n    echo \"Running TPA scan on $arch image manifest...\"\n    tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n    digests_processed+=(\"\\\"$arch_sha\\\"\")\n  else\n    echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n    exit 1\n  fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n  arch=\"${platform#*/}\"\n  if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n    arch=\"amd64\"\n  fi\n  # Validate against supported arch list. If it's not a known arch, fallback to amd64\n  case \"$arch\" in\n    amd64|ppc64le|arm64|s390x)\n      ;;\n    *)\n      echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n      exit 1\n      ;;\n  esac\n\n  run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n  for sha_file in image-manifest-*.sha; do\n    if [ -e \"$sha_file\" ]; then\n      arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n      run_tpa_on_arch \"$arch\"\n    fi\n  done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n  digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "SKIP_OCI_ATTACH_REPORT",
                                    "value": "false"
                                },
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                                }
                            ],
                            "image": "quay.io/konflux-ci/task-runner:2.1.0@sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9",
                            "name": "oci-attach-report",
                            "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n  echo 'OCI attach report skipped by parameter.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n  echo 'No TPA reports generated. Skipping upload.'\n  echo '{}' \u003e reports.json\n  exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n  report_file=\"$1\"\n  arch=\"${report_file/*-}\"\n  echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n  digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n  image_ref=\"${repository}@${digest}\"\n  mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n  export DOCKER_CONFIG=/tmp/auth\n  echo \"Attaching $f to ${image_ref}\"\n  if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n    \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n  then\n    echo \"Failed to attach ${f} to ${image_ref}\"\n    exit 1\n  fi\n  # shellcheck disable=SC2016\n  reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n",
                            "workingDir": "/tekton/home"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "conftest-vulnerabilities",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n  echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n  exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n  file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n  if [ ! -s \"$file\" ]; then\n    echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n  else\n    /usr/bin/conftest test --no-fail $file \\\n    --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n    --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n  fi\n\n  #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n  if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n    missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n  fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n  note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n  TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n  echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n  echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n  exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n    result=$(jq -rce \\\n        '{\n            vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            },\n            unpatched_vulnerabilities:{\n              critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n              unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n            }\n        }' \"$file\")\n\n    scan_result=$(jq -s -rce \\\n          '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n          .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n          .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n          .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n          .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n          .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n          .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n          .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n          .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n          .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n          .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n",
                            "securityContext": {
                                "capabilities": {
                                    "add": [
                                        "SETFCAP"
                                    ]
                                }
                            }
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/commit_sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "default",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "default",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fjwlxg",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"default\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c/records/e5a4ce6d-32d9-4a9e-9c89-da3fe858eaf1",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-aadpde\",\"commit\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/categories": "Git",
                    "tekton.dev/displayName": "git clone oci trusted artifacts",
                    "tekton.dev/pipelines.minVersion": "0.21.0",
                    "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64",
                    "tekton.dev/tags": "git",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-test-custom-default-yvxxpm"
                },
                "creationTimestamp": "2026-08-13T08:19:24Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-test-application-tewl",
                    "appstudio.openshift.io/component": "fj-test-custom-default-yvxxpm",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                    "tekton.dev/pipelineRunUID": "7bc31381-1a07-4292-b159-a319b4c5753c",
                    "tekton.dev/pipelineTask": "clone-repository",
                    "tekton.dev/task": "git-clone-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "04614a78cb064f85908ed6bb75f06216dae90674fa1d7fb8c50d8bdf4bd551"
                },
                "name": "fj-test-customb4cf8837b3dfb0576ddcb9be5ae4efd9-clone-repository",
                "namespace": "build-e2e-yjiw",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                        "uid": "7bc31381-1a07-4292-b159-a319b4c5753c"
                    }
                ],
                "resourceVersion": "20176",
                "uid": "e5a4ce6d-32d9-4a9e-9c89-da3fe858eaf1"
            },
            "spec": {
                "params": [
                    {
                        "name": "url",
                        "value": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde"
                    },
                    {
                        "name": "revision",
                        "value": "2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    },
                    {
                        "name": "ociStorage",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b.git"
                    },
                    {
                        "name": "ociArtifactExpiresAfter",
                        "value": "5d"
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-test-custom-default-yvxxpm",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "git-clone-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.2.4@sha256:f90deac0d63b43c7cb3f0b2d83ee56aa7fa18bb493f084286c6a953bbf479d8d"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s",
                "workspaces": [
                    {
                        "name": "basic-auth",
                        "secret": {
                            "secretName": "pac-gitauth-fjwlxg"
                        }
                    }
                ]
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:19:42Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:19:42Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-test-customb4cf8837b3dfb0cb76e3fdfedc16ee9f1b93520f6c6af-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "f90deac0d63b43c7cb3f0b2d83ee56aa7fa18bb493f084286c6a953bbf479d8d"
                        },
                        "entryPoint": "git-clone-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "CHAINS-GIT_COMMIT",
                        "type": "string",
                        "value": "2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    },
                    {
                        "name": "CHAINS-GIT_URL",
                        "type": "string",
                        "value": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde"
                    },
                    {
                        "name": "commit",
                        "type": "string",
                        "value": "2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    },
                    {
                        "name": "commit-timestamp",
                        "type": "string",
                        "value": "1786607600"
                    },
                    {
                        "name": "short-commit",
                        "type": "string",
                        "value": "2f5b237"
                    },
                    {
                        "name": "url",
                        "type": "string",
                        "value": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde"
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "type": "string",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0"
                    }
                ],
                "startTime": "2026-08-13T08:19:26Z",
                "steps": [
                    {
                        "container": "step-clone",
                        "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:fddbb4c2edb01a3f0065321f84cf2e4d8e483b4149e3d6f78dd0c46e85e35aef",
                        "name": "clone",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://de39ce8fce6e8f9de99b1ea8fa4467adfee3d649684fa77c30fe914d03941465",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:19:38Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde\",\"type\":1},{\"key\":\"commit\",\"value\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1786607600\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"2f5b237\",\"type\":1},{\"key\":\"url\",\"value\":\"https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:19:35Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-create-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                        "name": "create-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://46518d8044fc7761571ca655b842544b0f56155f4d04fd959a7dcc3fe80c9404",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:19:41Z",
                            "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0\",\"type\":1},{\"key\":\"commit\",\"value\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1786607600\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"2f5b237\",\"type\":1},{\"key\":\"url\",\"value\":\"https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:19:39Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.",
                    "params": [
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "1",
                            "description": "Perform a shallow clone, fetching only the most recent N commits.",
                            "name": "depth",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n",
                            "name": "enableSymlinkCheck",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Fetch all tags for the repo.",
                            "name": "fetchTags",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTP proxy server for non-SSL requests.",
                            "name": "httpProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "HTTPS proxy server for SSL requests.",
                            "name": "httpsProxy",
                            "type": "string"
                        },
                        {
                            "default": "info",
                            "description": "Log level for the git-clone command.",
                            "name": "logLevel",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n",
                            "name": "mergeSourceDepth",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n",
                            "name": "mergeSourceRepoUrl",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.",
                            "name": "mergeTargetBranch",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Opt out of proxying HTTP/HTTPS requests.",
                            "name": "noProxy",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.",
                            "name": "ociArtifactExpiresAfter",
                            "type": "string"
                        },
                        {
                            "description": "The OCI repository where the Trusted Artifacts are stored.",
                            "name": "ociStorage",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Refspec to fetch before checking out revision.",
                            "name": "refspec",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Revision to checkout. (branch, tag, sha, ref, etc...)",
                            "name": "revision",
                            "type": "string"
                        },
                        {
                            "default": "7",
                            "description": "Minimum length of the short commit SHA. Git may return a longer prefix if needed for uniqueness.",
                            "name": "shortCommitLength",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Define the directory patterns to match or exclude when performing a sparse checkout.",
                            "name": "sparseCheckoutDirectories",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.",
                            "name": "sslVerify",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched. Empty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.",
                            "name": "submodulePaths",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Initialize and fetch git submodules.",
                            "name": "submodules",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "CSV list of path patterns to exclude from the symlink check. Symlinks whose paths match\nare not checked. Patterns are relative to the checkout directory and must not start with '/'.\nUse '*' and '?' as wildcards ('*' matches across '/').\nQuote patterns containing commas using CSV double quotes.\n",
                            "name": "symlinkCheckIgnorePattern",
                            "type": "string"
                        },
                        {
                            "default": "main",
                            "description": "The target branch to merge into the revision (if mergeTargetBranch is true).",
                            "name": "targetBranch",
                            "type": "string"
                        },
                        {
                            "description": "Repository URL to clone from.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_COMMIT",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.",
                            "name": "CHAINS-GIT_URL",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "description": "The precise commit SHA that was fetched by this Task.",
                            "name": "commit",
                            "type": "string"
                        },
                        {
                            "description": "The commit timestamp of the checkout",
                            "name": "commit-timestamp",
                            "type": "string"
                        },
                        {
                            "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).",
                            "name": "merged_sha",
                            "type": "string"
                        },
                        {
                            "description": "Abbreviated commit SHA for the checkout. At least params.shortCommitLength characters; longer if Git requires more for uniqueness.",
                            "name": "short-commit",
                            "type": "string"
                        },
                        {
                            "description": "The precise URL that was fetched by this Task.",
                            "name": "url",
                            "type": "string"
                        }
                    ],
                    "steps": [
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KBC_GIT_CLONE_URL",
                                    "value": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_REVISION",
                                    "value": "2f5b237f399a1da39af4d15fc7049242c0a4948b"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_REFSPEC"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBMODULES",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBMODULE_PATHS"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_DEPTH",
                                    "value": "1"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SHORT_COMMIT_LENGTH",
                                    "value": "7"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SSL_VERIFY",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SPARSE_CHECKOUT_DIRECTORIES"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_ENABLE_SYMLINK_CHECK",
                                    "value": "true"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SYMLINK_CHECK_IGNORE_PATTERN"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_FETCH_TAGS",
                                    "value": "false"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_TARGET_BRANCH",
                                    "value": "false"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_TARGET_BRANCH",
                                    "value": "main"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_SOURCE_REPO_URL"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_MERGE_SOURCE_DEPTH"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_BASIC_AUTH_DIRECTORY",
                                    "value": "/workspace/basic-auth"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SSH_DIRECTORY"
                                },
                                {
                                    "name": "PARAM_HTTP_PROXY"
                                },
                                {
                                    "name": "PARAM_HTTPS_PROXY"
                                },
                                {
                                    "name": "PARAM_NO_PROXY"
                                },
                                {
                                    "name": "KBC_LOG_LEVEL",
                                    "value": "info"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_OUTPUT_DIR",
                                    "value": "/var/workdir"
                                },
                                {
                                    "name": "KBC_GIT_CLONE_SUBDIRECTORY",
                                    "value": "source"
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:fddbb4c2edb01a3f0065321f84cf2e4d8e483b4149e3d6f78dd0c46e85e35aef",
                            "name": "clone",
                            "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf \"$ca_bundle\" /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\nRESULT_FILE=\"$(mktemp)\"\nkonflux-build-cli git-clone \u003e\"${RESULT_FILE}\"\n\nprintf \"%s\" \"$(jq -r '.commit' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"$(jq -r '.shortCommit' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"$(jq -r '.url' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"$(jq -r '.commitTimestamp' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/commit-timestamp\"\nprintf \"%s\" \"$(jq -r '.\"CHAINS-GIT_URL\"' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(jq -r '.\"CHAINS-GIT_COMMIT\"' \"${RESULT_FILE}\")\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\n\nMERGED_SHA=$(jq -r '.mergedSha // empty' \"${RESULT_FILE}\")\nif [ -n \"${MERGED_SHA}\" ]; then\n  printf \"%s\" \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\nfi\n",
                            "securityContext": {
                                "runAsUser": 0
                            },
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                },
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                }
                            ]
                        },
                        {
                            "args": [
                                "create",
                                "--store",
                                "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b.git",
                                "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source"
                            ],
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_EXPIRES_AFTER",
                                    "value": "5d"
                                }
                            ],
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:7c51a3530f239323442e28ea7dace8b88a14638d823d5eaa8514843c33b03c02",
                            "name": "create-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/var/workdir",
                                    "name": "workdir"
                                },
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ],
                    "workspaces": [
                        {
                            "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n",
                            "name": "basic-auth",
                            "optional": true
                        },
                        {
                            "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n",
                            "name": "ssh-directory",
                            "optional": true
                        }
                    ]
                }
            }
        },
        {
            "apiVersion": "tekton.dev/v1",
            "kind": "TaskRun",
            "metadata": {
                "annotations": {
                    "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/commit_sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "build.appstudio.redhat.com/pull_request_number": "1",
                    "build.appstudio.redhat.com/target_branch": "default",
                    "chains.tekton.dev/signed": "true",
                    "pipeline.tekton.dev/release": "70f7308",
                    "pipelinesascode.tekton.dev/branch": "default",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-fjwlxg",
                    "pipelinesascode.tekton.dev/git-provider": "gitea",
                    "pipelinesascode.tekton.dev/log-url": "https://dashboard.is.not.configured",
                    "pipelinesascode.tekton.dev/max-keep-runs": "3",
                    "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"default\"",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true",
                    "pipelinesascode.tekton.dev/secret-created": "true",
                    "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/sha-title": "Konflux update fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde/commit/2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/source-branch": "konflux-fj-test-custom-default-yvxxpm",
                    "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "results.tekton.dev/childReadyForDeletion": "true",
                    "results.tekton.dev/record": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c/records/e9895e1f-8761-4bbf-96b2-d59a1135396e",
                    "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-aadpde\",\"commit\":\"2f5b237f399a1da39af4d15fc7049242c0a4948b\",\"eventType\":\"pull_request\",\"pull_request-id\":1}",
                    "results.tekton.dev/result": "build-e2e-yjiw/results/7bc31381-1a07-4292-b159-a319b4c5753c",
                    "results.tekton.dev/stored": "true",
                    "tekton.dev/pipelines.minVersion": "0.12.1",
                    "tekton.dev/tags": "konflux",
                    "test.appstudio.openshift.io/pr-group": "konflux-fj-test-custom-default-yvxxpm"
                },
                "creationTimestamp": "2026-08-13T08:22:20Z",
                "finalizers": [
                    "chains.tekton.dev/taskrun",
                    "results.tekton.dev/taskrun"
                ],
                "generation": 1,
                "labels": {
                    "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
                    "app.kubernetes.io/version": "v0.50.0",
                    "appstudio.openshift.io/application": "build-suite-test-application-tewl",
                    "appstudio.openshift.io/component": "fj-test-custom-default-yvxxpm",
                    "pipelines.appstudio.openshift.io/type": "build",
                    "pipelinesascode.tekton.dev/cancel-in-progress": "true",
                    "pipelinesascode.tekton.dev/event-type": "pull_request",
                    "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "pipelinesascode.tekton.dev/pull-request": "1",
                    "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-aadpde",
                    "pipelinesascode.tekton.dev/sha": "2f5b237f399a1da39af4d15fc7049242c0a4948b",
                    "pipelinesascode.tekton.dev/state": "started",
                    "pipelinesascode.tekton.dev/url-org": "konflux-qe",
                    "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-aadpde",
                    "tekton.dev/memberOf": "tasks",
                    "tekton.dev/pipeline": "fj-test-custom-default-yvxxpm-on-pull-request",
                    "tekton.dev/pipelineRun": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                    "tekton.dev/pipelineRunUID": "7bc31381-1a07-4292-b159-a319b4c5753c",
                    "tekton.dev/pipelineTask": "sast-shell-check",
                    "tekton.dev/task": "sast-shell-check-oci-ta-min",
                    "test.appstudio.openshift.io/pr-group-sha": "04614a78cb064f85908ed6bb75f06216dae90674fa1d7fb8c50d8bdf4bd551"
                },
                "name": "fj-test-customb4cf8837b3dfb0576ddcb9be5ae4efd9-sast-shell-check",
                "namespace": "build-e2e-yjiw",
                "ownerReferences": [
                    {
                        "apiVersion": "tekton.dev/v1",
                        "blockOwnerDeletion": true,
                        "controller": true,
                        "kind": "PipelineRun",
                        "name": "fj-test-custom-default-yvxxpm-on-pull-request-fw42p",
                        "uid": "7bc31381-1a07-4292-b159-a319b4c5753c"
                    }
                ],
                "resourceVersion": "23276",
                "uid": "e9895e1f-8761-4bbf-96b2-d59a1135396e"
            },
            "spec": {
                "params": [
                    {
                        "name": "image-digest",
                        "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                    },
                    {
                        "name": "image-url",
                        "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                    },
                    {
                        "name": "TARGET_DIRS",
                        "value": "."
                    },
                    {
                        "name": "SOURCE_ARTIFACT",
                        "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0"
                    },
                    {
                        "name": "CACHI2_ARTIFACT",
                        "value": ""
                    }
                ],
                "serviceAccountName": "build-pipeline-fj-test-custom-default-yvxxpm",
                "taskRef": {
                    "params": [
                        {
                            "name": "name",
                            "value": "sast-shell-check-oci-ta-min"
                        },
                        {
                            "name": "bundle",
                            "value": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min:0.1@sha256:b25a46b20e09eacec4e177cdd8d18a31fea38e9e346b49215e6e5044a00b8d85"
                        },
                        {
                            "name": "kind",
                            "value": "task"
                        }
                    ],
                    "resolver": "bundles"
                },
                "timeout": "1h0m0s"
            },
            "status": {
                "artifacts": {},
                "completionTime": "2026-08-13T08:23:00Z",
                "conditions": [
                    {
                        "lastTransitionTime": "2026-08-13T08:23:00Z",
                        "message": "All Steps have completed executing",
                        "reason": "Succeeded",
                        "status": "True",
                        "type": "Succeeded"
                    }
                ],
                "podName": "fj-test-customb4cf8837b3dfb63a5ba698df47a947871d8bcb18c8d13-pod",
                "provenance": {
                    "featureFlags": {
                        "awaitSidecarReadiness": true,
                        "coschedule": "workspaces",
                        "enableAPIFields": "beta",
                        "enableProvenanceInStatus": true,
                        "enforceNonfalsifiability": "none",
                        "maxResultSize": 4096,
                        "resultExtractionMethod": "termination-message",
                        "runningInEnvWithInjectedSidecars": true,
                        "sendCloudEventsForRuns": true,
                        "verificationNoMatchPolicy": "ignore"
                    },
                    "refSource": {
                        "digest": {
                            "sha256": "b25a46b20e09eacec4e177cdd8d18a31fea38e9e346b49215e6e5044a00b8d85"
                        },
                        "entryPoint": "sast-shell-check-oci-ta-min",
                        "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta-min"
                    }
                },
                "results": [
                    {
                        "name": "TEST_OUTPUT",
                        "type": "string",
                        "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-08-13T08:22:57+00:00\",\"note\":\"For details, check Tekton task log.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n"
                    }
                ],
                "startTime": "2026-08-13T08:22:20Z",
                "steps": [
                    {
                        "container": "step-use-trusted-artifact",
                        "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                        "name": "use-trusted-artifact",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://b055456e5231c51804025894163b49082a5686acd35c897d99de3f69f06d99bf",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:49Z",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:48Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-sast-shell-check",
                        "imageID": "quay.io/konflux-ci/konflux-test@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                        "name": "sast-shell-check",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://a95d052406203f959f605f67999d6674ef07463929ee24a1e993a79e81af44a7",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:22:58Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:57+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:49Z"
                        },
                        "terminationReason": "Completed"
                    },
                    {
                        "container": "step-upload",
                        "imageID": "quay.io/konflux-ci/oras@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                        "name": "upload",
                        "provenance": {},
                        "terminated": {
                            "containerID": "containerd://fe1b55611af961d1808efe005c34bc2e576f3ad16de413cfc2161a39981ac582",
                            "exitCode": 0,
                            "finishedAt": "2026-08-13T08:23:00Z",
                            "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-08-13T08:22:57+00:00\\\",\\\"note\\\":\\\"For details, check Tekton task log.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]",
                            "reason": "Completed",
                            "startedAt": "2026-08-13T08:22:58Z"
                        },
                        "terminationReason": "Completed"
                    }
                ],
                "taskSpec": {
                    "description": "The sast-shell-check task uses [shellcheck](https://www.shellcheck.net/) tool to perform Static Application Security Testing (SAST), a popular cloud-native application security platform. This task leverages the shellcheck wrapper (csmock-plugin-shellcheck-core) to run shellcheck on a directory tree.\nShellCheck is a static analysis tool, gives warnings and suggestions for bash/sh shell scripts. This task can run on x86 and arm.",
                    "params": [
                        {
                            "default": "",
                            "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.",
                            "name": "CACHI2_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to include important findings only",
                            "name": "IMP_FINDINGS_ONLY",
                            "type": "string"
                        },
                        {
                            "default": "SITE_DEFAULT",
                            "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.",
                            "name": "KFP_GIT_URL",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.",
                            "name": "PROJECT_NAME",
                            "type": "string"
                        },
                        {
                            "default": "false",
                            "description": "Whether to record the excluded findings (default to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n",
                            "name": "RECORD_EXCLUDED",
                            "type": "string"
                        },
                        {
                            "default": "true",
                            "description": "Whether to skip files containing Jinja2 template syntax ({{ }}, {% %}, {# #}). ShellCheck cannot parse Jinja2 constructs, so scanning such files produces unreliable findings.",
                            "name": "SKIP_JINJA",
                            "type": "string"
                        },
                        {
                            "description": "The Trusted Artifact URI pointing to the artifact with the application source code.",
                            "name": "SOURCE_ARTIFACT",
                            "type": "string"
                        },
                        {
                            "default": ".",
                            "description": "Target directories in component's source code. Multiple values should be separated with commas.",
                            "name": "TARGET_DIRS",
                            "type": "string"
                        },
                        {
                            "default": "ca-bundle.crt",
                            "description": "The name of the key in the ConfigMap that contains the CA bundle data.",
                            "name": "caTrustConfigMapKey",
                            "type": "string"
                        },
                        {
                            "default": "trusted-ca",
                            "description": "The name of the ConfigMap to read CA bundle data from.",
                            "name": "caTrustConfigMapName",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image digest to report findings for.",
                            "name": "image-digest",
                            "type": "string"
                        },
                        {
                            "default": "",
                            "description": "Image URL.",
                            "name": "image-url",
                            "type": "string"
                        }
                    ],
                    "results": [
                        {
                            "description": "Tekton task test output.",
                            "name": "TEST_OUTPUT",
                            "type": "string"
                        }
                    ],
                    "stepTemplate": {
                        "computeResources": {},
                        "volumeMounts": [
                            {
                                "mountPath": "/var/workdir",
                                "name": "workdir"
                            }
                        ]
                    },
                    "steps": [
                        {
                            "args": [
                                "use",
                                "oci:quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm@sha256:8808ea0c6c73836da306cb4fa3cfab5d70b65275164196b3eb49f35be3498de0=/var/workdir/source",
                                "=/var/workdir/cachi2"
                            ],
                            "computeResources": {},
                            "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:254989d35310c0998eb2ae60aa4703da842d99d82ed434fd5208cc9639d32969",
                            "name": "use-trusted-artifact",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ]
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "128m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "KFP_GIT_URL",
                                    "value": "SITE_DEFAULT"
                                },
                                {
                                    "name": "PROJECT_NAME"
                                },
                                {
                                    "name": "RECORD_EXCLUDED",
                                    "value": "false"
                                },
                                {
                                    "name": "IMP_FINDINGS_ONLY",
                                    "value": "true"
                                },
                                {
                                    "name": "TARGET_DIRS",
                                    "value": "."
                                },
                                {
                                    "name": "SKIP_JINJA",
                                    "value": "true"
                                },
                                {
                                    "name": "COMPONENT_LABEL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.labels['appstudio.openshift.io/component']"
                                        }
                                    }
                                },
                                {
                                    "name": "BUILD_PLR_LOG_URL",
                                    "valueFrom": {
                                        "fieldRef": {
                                            "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']"
                                        }
                                    }
                                }
                            ],
                            "image": "quay.io/konflux-ci/konflux-test:v1.5.4@sha256:dae74bf0d6fc349d3ae140d9e3a921ad5009fdf8dade3186bfd9b65fbe3a365b",
                            "name": "sast-shell-check",
                            "script": "#!/usr/bin/env bash\nset -x\n# shellcheck source=/dev/null\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n  PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n  echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n  cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n  update-ca-trust\nfi\n\nPACKAGE_VERSION=$(rpm -q --queryformat '%{NAME}-%{VERSION}-%{RELEASE}\\n' ShellCheck)\n\nOUTPUT_FILE=\"shellcheck-results.json\"\nSOURCE_CODE_DIR=/var/workdir/source\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nIFS=\",\" read -ra TARGET_ARRAY \u003c\u003c\u003c\"$TARGET_DIRS\"\nfor d in \"${TARGET_ARRAY[@]}\"; do\n  potential_path=\"${SOURCE_CODE_DIR}/${d}\"\n\n  resolved_path=$(realpath -m \"$potential_path\")\n\n  # ensure resolved path is still within SOURCE_CODE_DIR\n  if [[ \"$resolved_path\" == \"$SOURCE_CODE_DIR\"* ]]; then\n    ALL_TARGETS+=(\"$resolved_path\")\n  else\n    echo \"Error: path traversal attempt, '$potential_path' is outside '$SOURCE_CODE_DIR'\"\n    exit 1\n  fi\ndone\n\n# determine number of available CPU cores for shellcheck based on container cgroup v2 CPU limits\n# this calculates the ceiling, so if the cpu limit is 0.5, the number of jobs will be 1.\nif [ -z \"$SC_JOBS\" ] \u0026\u0026 [ -r \"/sys/fs/cgroup/cpu.max\" ]; then\n  read -r quota period \u003c/sys/fs/cgroup/cpu.max\n  if [ \"$quota\" != \"max\" ] \u0026\u0026 [ -n \"$period\" ] \u0026\u0026 [ \"$period\" -gt 0 ]; then\n    export SC_JOBS=$(((quota + period - 1) / period))\n    echo \"INFO: Setting SC_JOBS=${SC_JOBS} based on cgroups v2 max for run-shellcheck.sh\"\n  fi\nfi\n\nif [[ \"${SKIP_JINJA}\" == \"true\" ]]; then\n  export SC_SKIP_JINJA=1\nfi\n\n# generate all shellcheck result JSON files to $SC_RESULTS_DIR, which defaults to ./shellcheck-results/\n/usr/share/csmock/scripts/run-shellcheck.sh \"${ALL_TARGETS[@]}\"\n\nCSGREP_OPTS=(\n  --mode=json\n  --strip-path-prefix=\"$SOURCE_CODE_DIR\"/\n  --remove-duplicates\n  --embed-context=3\n  --set-scan-prop=\"ShellCheck:${PACKAGE_VERSION}\"\n)\nif [[ \"$IMP_FINDINGS_ONLY\" == \"true\" ]]; then\n  # predefined list of shellcheck important findings\n  CSGREP_EVENT_FILTER='\\[SC(1020|1035|1054|1066|1068|1073|1080|1083|1099|1113|1115|1127|1128|1143|2043|2050|'\n  CSGREP_EVENT_FILTER+='2055|2057|2066|2069|2071|2077|2078|2091|2092|2157|2171|2193|2194|2195|2215|2216|'\n  CSGREP_EVENT_FILTER+='2218|2224|2225|2242|2256|2258|2261)\\]$'\n  CSGREP_OPTS+=(\n    --event=\"$CSGREP_EVENT_FILTER\"\n  )\nelse\n  CSGREP_OPTS+=(\n    --event=\"error|warning\"\n  )\nfi\n\nif ! csgrep \"${CSGREP_OPTS[@]}\" ./shellcheck-results/*.json \u003e\"$OUTPUT_FILE\"; then\n  echo \"Error occurred while running 'run-shellcheck.sh'\"\n  note=\"Task sast-shell-check-oci-ta-min failed: For details, check Tekton task log.\"\n  ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n  echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n  exit 1\nfi\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n  KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n  # Default location only reachable from internal Konflux instances, check reachable first\n  echo -n \"INFO: Probing ${PROBE_URL}... \"\n  if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n    echo \"INFO: Trying to clone known-false-positives..\"\n    git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n  fi\nfi\n\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n  echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\nelse\n  echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n  # build initial csfilter-kfp command\n  csfilter_kfp_cmd=(\n    csfilter-kfp\n    --verbose\n    --kfp-dir=\"${KFP_DIR}\"\n    --project-nvr=\"${PROJECT_NAME}\"\n  )\n\n  if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n    csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n  fi\n\n  # Execute the command and capture any errors\n  set +e\n  \"${csfilter_kfp_cmd[@]}\" \"${OUTPUT_FILE}\" \u003e\"${OUTPUT_FILE}.filtered\" 2\u003e\"${OUTPUT_FILE}.error\"\n  status=$?\n  set -e\n  if [ \"$status\" -ne 0 ]; then\n    echo \"WARN: failed to filter known false positives\" \u003e\u00262\n  else\n    mv \"${OUTPUT_FILE}.filtered\" \"$OUTPUT_FILE\"\n    echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n  fi\nfi\n\necho \"ShellCheck results have been saved to $OUTPUT_FILE\"\n\ncsgrep --mode=evtstat \"$OUTPUT_FILE\"\ncsgrep --mode=sarif \"$OUTPUT_FILE\" \u003eshellcheck-results.sarif\n\nTEST_OUTPUT=\nparse_test_output \"sast-shell-check-oci-ta-min\" sarif shellcheck-results.sarif || true\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/mnt/trusted-ca",
                                    "name": "trusted-ca",
                                    "readOnly": true
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        },
                        {
                            "computeResources": {
                                "limits": {
                                    "memory": "256Mi"
                                },
                                "requests": {
                                    "cpu": "100m",
                                    "memory": "256Mi"
                                }
                            },
                            "env": [
                                {
                                    "name": "IMAGE_URL",
                                    "value": "quay.io/redhat-appstudio-qe/build-e2e-yjiw/fj-test-custom-default-yvxxpm:on-pr-2f5b237f399a1da39af4d15fc7049242c0a4948b"
                                },
                                {
                                    "name": "IMAGE_DIGEST",
                                    "value": "sha256:40b1caf1c154eb3d230cbcefc4aef9d9536a148702b8443d9f44344749d48711"
                                }
                            ],
                            "image": "quay.io/konflux-ci/oras:latest@sha256:561847430299db122ba499a3c1a4e28d850c191c9da6048a23361963eda49cac",
                            "name": "upload",
                            "script": "#!/usr/bin/env bash\nset -e\n\nif [ -z \"${IMAGE_URL}\" ] || [ -z \"${IMAGE_DIGEST}\" ]; then\n  echo 'No image-url or image-digest param provided. Skipping upload.'\n  exit 0\nfi\n\nUPLOAD_FILES=\"shellcheck-results.sarif excluded-findings.json\"\n\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n  if [ ! -f \"${UPLOAD_FILE}\" ]; then\n    echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n    continue\n  fi\n\n  # Determine the media type based on the file extension\n  if [[ \"${UPLOAD_FILE}\" == *.json ]]; then\n    MEDIA_TYPE=\"application/json\"\n  else\n    MEDIA_TYPE=\"application/sarif+json\"\n  fi\n\n  echo \"Selecting auth\"\n  select-oci-auth \"$IMAGE_URL\" \u003e\"$HOME/auth.json\"\n  echo \"Attaching to ${IMAGE_URL}\"\n  if ! retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"; then\n    echo \"Failed to attach ${UPLOAD_FILE} to ${IMAGE_URL}\"\n    exit 1\n  fi\ndone\n",
                            "volumeMounts": [
                                {
                                    "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt",
                                    "name": "trusted-ca",
                                    "readOnly": true,
                                    "subPath": "ca-bundle.crt"
                                }
                            ],
                            "workingDir": "/var/workdir/source"
                        }
                    ],
                    "volumes": [
                        {
                            "configMap": {
                                "items": [
                                    {
                                        "key": "ca-bundle.crt",
                                        "path": "ca-bundle.crt"
                                    }
                                ],
                                "name": "trusted-ca",
                                "optional": true
                            },
                            "name": "trusted-ca"
                        },
                        {
                            "emptyDir": {},
                            "name": "workdir"
                        }
                    ]
                }
            }
        }
    ],
    "kind": "List",
    "metadata": {
        "resourceVersion": ""
    }
}