{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.redhat.com/nudged-components": "gl-multi-component-child-trpb", "build.appstudio.redhat.com/nudging-commit": "41901d11f479a0ccb0b7e4975a96c894fe81b0d7", "build.appstudio.redhat.com/nudging-component": "gl-multi-component-parent-trpb", "build.appstudio.redhat.com/nudging-image": "quay.io/redhat-appstudio-qe/build-e2e-pqva/gl-multi-component-parent-trpb:41901d11f479a0ccb0b7e4975a96c894fe81b0d7", "build.appstudio.redhat.com/nudging-pipeline": "gl-multi-component-parent-trpb-on-push-s7nw2", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-pqva/results/e0e597ed-26cb-42b3-97df-3c9f28a5244f/records/13eec384-9485-4323-9070-a31c577fbf7c", "results.tekton.dev/result": "build-e2e-pqva/results/e0e597ed-26cb-42b3-97df-3c9f28a5244f", "results.tekton.dev/stored": "true" }, "creationTimestamp": "2026-05-12T09:48:49Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "build.appstudio.redhat.com/type": "nudge", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-pipeline-1778579329-b8455", "tekton.dev/pipelineRun": "renovate-pipeline-1778579329-b8455", "tekton.dev/pipelineRunUID": "e0e597ed-26cb-42b3-97df-3c9f28a5244f", "tekton.dev/pipelineTask": "renovate" }, "name": "renovate-pipeline-1778579329-b8455-renovate", "namespace": "build-e2e-pqva", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-pipeline-1778579329-b8455", "uid": "e0e597ed-26cb-42b3-97df-3c9f28a5244f" } ], "resourceVersion": "26129", "uid": "13eec384-9485-4323-9070-a31c577fbf7c" }, "spec": { "serviceAccountName": "build-pipeline-gl-multi-component-parent-trpb", "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_fedbdb5906 RENOVATE_CONFIG_FILE=/configs/gl-multi-component-child-trpb-d1808.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_pqva_gl_multi_component_parent_trpb_18ef724551','password':'${TOKEN_65bb575457}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1778579329-b8455" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1778579329-b8455" } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1778579329-b8455" }, "name": "renovate-pipeline-1778579329-b8455" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-12T09:51:33Z", "conditions": [ { "lastTransitionTime": "2026-05-12T09:51:33Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "renovate-pipeline-1778579329-b8455-renovate-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-05-12T09:48:49Z", "steps": [ { "container": "step-renovate", "imageID": "quay.io/konflux-ci/mintmaker-renovate-image@sha256:67d26b20533790565a2949a3f732d595dda9378fea506f1cba88ca17cef13873", "name": "renovate", "provenance": {}, "terminated": { "containerID": "containerd://524a0861d1381aa7f65d14bb236c6c083127d1560d3f389d3b7026dc2db48a84", "exitCode": 0, "finishedAt": "2026-05-12T09:51:32Z", "reason": "Completed", "startedAt": "2026-05-12T09:51:18Z" }, "terminationReason": "Completed" } ], "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_fedbdb5906 RENOVATE_CONFIG_FILE=/configs/gl-multi-component-child-trpb-d1808.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_pqva_gl_multi_component_parent_trpb_18ef724551','password':'${TOKEN_65bb575457}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1778579329-b8455" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1778579329-b8455" } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1778579329-b8455" }, "name": "renovate-pipeline-1778579329-b8455" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/tree/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/commit_sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/target_branch": "base-zulcdf", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-zulcdf", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yrwtry", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/log-url": "https://44.253.176.196:9443/ns/build-e2e-uiwy/pipelinerun/gl-test-custom-branch-lqwehi-on-push-s7wz6", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-zulcdf\"", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-test-custom-branch-lqwehi' into 'base-zulcdf'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/commit/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-zulcdf", "pipelinesascode.tekton.dev/source-project-id": "82120572", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/target-project-id": "82120572", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4/records/0e1e22ca-62c0-4397-acf2-35d6c1f51fc8", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-ehvmll\",\"commit\":\"0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux" }, "creationTimestamp": "2026-05-12T09:51:17Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-05-12T09:52:16Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-socu", "appstudio.openshift.io/component": "gl-test-custom-branch-lqwehi", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRun": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRunUID": "6ecf52c9-d967-4f2c-a1a1-792b582262c4", "tekton.dev/pipelineTask": "deprecated-base-image-check", "tekton.dev/task": "deprecated-image-check" }, "name": "gl-8f4e35bc993fe2799349c4a83bf2a5de-deprecated-base-image-check", "namespace": "build-e2e-uiwy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "uid": "6ecf52c9-d967-4f2c-a1a1-792b582262c4" } ], "resourceVersion": "26478", "uid": "0e1e22ca-62c0-4397-acf2-35d6c1f51fc8" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" }, { "name": "IMAGE_DIGEST", "value": "sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3" } ], "serviceAccountName": "build-pipeline-gl-test-custom-branch-lqwehi", "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-12T09:51:35Z", "conditions": [ { "lastTransitionTime": "2026-05-12T09:51:35Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-8f4e35bc993fe2799349c4a823128307e7380dfb6b9c00dc1296277c-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "3457a4ca93f8d55f14ebd407532b1223c689eacc34f0abb3003db4111667bdae" }, "entryPoint": "deprecated-image-check", "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\", \"digests\": [\"sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-05-12T09:51:34+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n" } ], "startTime": "2026-05-12T09:51:17Z", "steps": [ { "container": "step-check-images", "imageID": "quay.io/konflux-ci/konflux-test@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9", "name": "check-images", "provenance": {}, "terminated": { "containerID": "containerd://f7c484e9d2796b5ae043f2c8456ecc15796b2406064c9d9063672162430217a4", "exitCode": 0, "finishedAt": "2026-05-12T09:51:34Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\\\", \\\"digests\\\": [\\\"sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-05-12T09:51:34+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-12T09:51:26Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.", "params": [ { "default": "/project/repository/", "description": "Path to directory containing Conftest policies.", "name": "POLICY_DIR", "type": "string" }, { "default": "required_checks", "description": "Namespace for Conftest policy.", "name": "POLICY_NAMESPACE", "type": "string" }, { "default": "", "description": "Digests of base build images.", "name": "BASE_IMAGES_DIGESTS", "type": "string" }, { "description": "Fully qualified image name.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "POLICY_DIR", "value": "/project/repository/" }, { "name": "POLICY_NAMESPACE", "value": "required_checks" }, { "name": "BASE_IMAGES_DIGESTS" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" }, { "name": "IMAGE_DIGEST", "value": "sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.49@sha256:74899c7a3dde27548e1ad9c665055bfef56c227251bd9224885f4bbd7addebd9", "name": "check-images", "script": "#!/usr/bin/env bash\nset -euo pipefail\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo -n $imagewithouttag@$IMAGE_DIGEST)\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n while read -r arch arch_sha; do\n SBOM_FILE_PATH=$(echo \"/tmp/sbom-$arch.json\")\n arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n # Get base images from SBOM\n cosign download sbom $arch_imageanddigest \u003e ${SBOM_FILE_PATH}\n if [ $? -ne 0 ]; then\n echo \"Unable to download sbom for arch $arch.\"\n continue\n fi\n\n \u003c \"${SBOM_FILE_PATH}\" jq -r '\n if .bomFormat == \"CycloneDX\" then\n .formulation[]?\n | .components[]?\n | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n | (\n .purl\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n else\n .packages[]\n | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n | (\n $purls | first\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n end\n ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"Detected base images from $arch SBOM:\"\n cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"\"\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n # Get images from the parameter\n for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n do\n echo $IMAGE_WITH_TAG | cut -d \":\" -f1 \u003e\u003e ${IMAGES_TO_BE_PROCESSED_PATH}\n done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c $BASE_IMAGE\n\n # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n export IMAGE_REPO_PATH=/tmp/${IMAGE_REPOSITORY}\n mkdir -p ${IMAGE_REPO_PATH}\n echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n http_code=$(curl -s -o ${IMAGE_REPO_PATH}/repository_data.json -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n if [ \"$http_code\" == \"200\" ];\n then\n echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n /usr/bin/conftest test --no-fail ${IMAGE_REPO_PATH}/repository_data.json \\\n --policy $POLICY_DIR --namespace $POLICY_NAMESPACE \\\n --output=json | tee ${IMAGE_REPO_PATH}/deprecated_image_check_output.json\n\n failures_num=$(jq -r '.[].failures|length' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n if [[ \"${failures_num}\" -gt 0 ]]; then\n echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n fi\n failure_counter=$((failure_counter+failures_num))\n\n successes_num=$(jq -r '.[].successes' ${IMAGE_REPO_PATH}/deprecated_image_check_output.json)\n if [[ \"${successes_num}\" -gt 0 ]]; then\n echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n fi\n success_counter=$((success_counter+successes_num))\n\n elif [ \"$http_code\" == \"404\" ];\n then\n echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n warnings_counter=$((warnings_counter+1))\n else\n echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n error_counter=$((error_counter+1))\n fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n if [[ \"${failure_counter}\" -gt 0 ]]; then\n RES=\"FAILURE\"\n elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n RES=\"WARNING\"\n elif [[ \"${success_counter}\" -eq 0 ]]; then\n # when all counters are 0, there are no base images to check\n note=\"Task deprecated-image-check success: No base images to check.\"\n RES=\"SUCCESS\"\n else\n RES=\"SUCCESS\"\n fi\n TEST_OUTPUT=$(make_result_json \\\n -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee /tekton/results/TEST_OUTPUT\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/tree/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/commit_sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/target_branch": "base-zulcdf", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-zulcdf", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yrwtry", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/log-url": "https://44.253.176.196:9443/ns/build-e2e-uiwy/pipelinerun/gl-test-custom-branch-lqwehi-on-push-s7wz6", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-zulcdf\"", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-test-custom-branch-lqwehi' into 'base-zulcdf'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/commit/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-zulcdf", "pipelinesascode.tekton.dev/source-project-id": "82120572", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/target-project-id": "82120572", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4/records/7b5f620b-e6cb-428b-8c7f-d356f40a7723", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-ehvmll\",\"commit\":\"0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux" }, "creationTimestamp": "2026-05-12T09:51:17Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-05-12T09:52:16Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-socu", "appstudio.openshift.io/component": "gl-test-custom-branch-lqwehi", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRun": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRunUID": "6ecf52c9-d967-4f2c-a1a1-792b582262c4", "tekton.dev/pipelineTask": "apply-tags", "tekton.dev/task": "apply-tags" }, "name": "gl-test-custom-branch-lqwehi-on-push-s7wz6-apply-tags", "namespace": "build-e2e-uiwy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "uid": "6ecf52c9-d967-4f2c-a1a1-792b582262c4" } ], "resourceVersion": "26464", "uid": "7b5f620b-e6cb-428b-8c7f-d356f40a7723" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" }, { "name": "IMAGE_DIGEST", "value": "sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3" } ], "serviceAccountName": "build-pipeline-gl-test-custom-branch-lqwehi", "taskRef": { "params": [ { "name": "name", "value": "apply-tags" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-12T09:51:41Z", "conditions": [ { "lastTransitionTime": "2026-05-12T09:51:41Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-test-custom-branch-lqwehi-on-push-s7wz6-apply-tags-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "a291081de7fb27f832c6fc3c4b078acf7e6162ca4c085db38b118ca87e8b5b66" }, "entryPoint": "apply-tags", "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags" } }, "startTime": "2026-05-12T09:51:21Z", "steps": [ { "container": "step-apply-additional-tags", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "apply-additional-tags", "provenance": {}, "terminated": { "containerID": "containerd://9035dba3adda9670869b85f5a7e8ba494c111f0aa86730343fe78326002bca65", "exitCode": 0, "finishedAt": "2026-05-12T09:51:40Z", "reason": "Completed", "startedAt": "2026-05-12T09:51:35Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Applies additional tags to the built image.", "params": [ { "description": "Image repository and tag reference of the the built image.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest of the built image.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": [], "description": "Additional tags that will be applied to the image in the registry.", "name": "ADDITIONAL_TAGS", "type": "array" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "info", "description": "Log level to use in the task. See golang logrus docs for available levels.", "name": "LOG_LEVEL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "args": [ "--image-url", "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "--digest", "sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3", "--tags", "--tags-from-image-label", "konflux.additional-tags" ], "command": [ "konflux-build-cli", "image", "apply-tags" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "apply-additional-tags" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/tree/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/commit_sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/target_branch": "base-zulcdf", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-zulcdf", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yrwtry", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/log-url": "https://44.253.176.196:9443/ns/build-e2e-uiwy/pipelinerun/gl-test-custom-branch-lqwehi-on-push-s7wz6", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-zulcdf\"", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-test-custom-branch-lqwehi' into 'base-zulcdf'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/commit/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-zulcdf", "pipelinesascode.tekton.dev/source-project-id": "82120572", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/target-project-id": "82120572", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4/records/dceafc95-ff9d-42d6-8d0c-571b20bd3ec5", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-ehvmll\",\"commit\":\"0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux" }, "creationTimestamp": "2026-05-12T09:51:17Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-05-12T09:52:16Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-socu", "appstudio.openshift.io/component": "gl-test-custom-branch-lqwehi", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRun": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRunUID": "6ecf52c9-d967-4f2c-a1a1-792b582262c4", "tekton.dev/pipelineTask": "clair-scan", "tekton.dev/task": "clair-scan" }, "name": "gl-test-custom-branch-lqwehi-on-push-s7wz6-clair-scan", "namespace": "build-e2e-uiwy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "uid": "6ecf52c9-d967-4f2c-a1a1-792b582262c4" } ], "resourceVersion": "26465", "uid": "dceafc95-ff9d-42d6-8d0c-571b20bd3ec5" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" } ], "serviceAccountName": "build-pipeline-gl-test-custom-branch-lqwehi", "taskRef": { "params": [ { "name": "name", "value": "clair-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-12T09:51:50Z", "conditions": [ { "lastTransitionTime": "2026-05-12T09:51:50Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-test-custom-branch-lqwehi-on-push-s7wz6-clair-scan-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609" }, "entryPoint": "clair-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\", \"digests\": [\"sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3\"]}}\n" }, { "name": "REPORTS", "type": "string", "value": "{\"sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3\":\"sha256:222572f902c8d9c9263b9d949f9310e56d905281cfa21c2e474f1f3d3a5cb603\"}\n" }, { "name": "SCAN_OUTPUT", "type": "string", "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-12T09:51:50+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "startTime": "2026-05-12T09:51:17Z", "steps": [ { "container": "step-get-image-manifests", "imageID": "quay.io/konflux-ci/konflux-test@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d", "name": "get-image-manifests", "provenance": {}, "terminated": { "containerID": "containerd://f417c59a82c7891463725a37cde52efacef7bdf68b1288d1db72187cd12ed55c", "exitCode": 0, "finishedAt": "2026-05-12T09:51:40Z", "reason": "Completed", "startedAt": "2026-05-12T09:51:35Z" }, "terminationReason": "Completed" }, { "container": "step-get-vulnerabilities", "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:932d686d7695528116c4988e147284ae6faec0fe2333c362af01c70d5eb1448c", "name": "get-vulnerabilities", "provenance": {}, "terminated": { "containerID": "containerd://7676f7b227d6485d093a45a4c0785b4caea6dd0cef3fefad2cd9332b4dcaa23a", "exitCode": 0, "finishedAt": "2026-05-12T09:51:44Z", "reason": "Completed", "startedAt": "2026-05-12T09:51:40Z" }, "terminationReason": "Completed" }, { "container": "step-oci-attach-report", "imageID": "quay.io/konflux-ci/oras@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705", "name": "oci-attach-report", "provenance": {}, "terminated": { "containerID": "containerd://3fedd2cd25b43cb34a730d583511d34d3ac4477f3f8acca13750a705a2be1706", "exitCode": 0, "finishedAt": "2026-05-12T09:51:48Z", "reason": "Completed", "startedAt": "2026-05-12T09:51:45Z" }, "terminationReason": "Completed" }, { "container": "step-conftest-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d", "name": "conftest-vulnerabilities", "provenance": {}, "terminated": { "containerID": "containerd://45be86c5f2850bf9bf5b96ad5438be3326114d2b1746091692237d1e50f64eb1", "exitCode": 0, "finishedAt": "2026-05-12T09:51:50Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\\\", \\\"digests\\\": [\\\"sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3\\\":\\\"sha256:222572f902c8d9c9263b9d949f9310e56d905281cfa21c2e474f1f3d3a5cb603\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-12T09:51:50+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-12T09:51:49Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "The platform built by.", "name": "image-platform", "type": "string" }, { "default": "", "description": "unused, should be removed in next task version.", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-oci-attach-report", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Clair scan result.", "name": "SCAN_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" }, { "description": "Mapping of image digests to report digests", "name": "REPORTS", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" }, { "name": "IMAGE_DIGEST", "value": "sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d", "name": "get-image-manifests", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n done\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } } }, { "computeResources": { "limits": { "cpu": "800m", "memory": "7Gi" }, "requests": { "cpu": "800m", "memory": "7Gi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" }, { "name": "IMAGE_DIGEST", "value": "sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3" }, { "name": "IMAGE_PLATFORM" } ], "image": "quay.io/konflux-ci/clair-in-ci:v1", "imagePullPolicy": "Always", "name": "get-vulnerabilities", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee \"clair-report-$2.json\"; } \u0026\u0026 \\\n { retry clair-action convert --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n local arch=\"$1\"\n local sha_file=\"image-manifest-$arch.sha\"\n\n if [ -e \"$sha_file\" ]; then\n local arch_sha\n arch_sha=$(\u003c\"$sha_file\")\n local digest=\"${imagewithouttag}@${arch_sha}\"\n\n echo \"Running clair-action on $arch image manifest...\"\n clair_report \"$digest\" \"$arch\" || true\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n arch=\"${platform#*/}\"\n if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n arch=\"amd64\"\n fi\n # Validate against supported arch list. If it's not a known arch, fallback to amd64\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n exit 0\n ;;\n esac\n\n run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n for sha_file in image-manifest-*.sha; do\n if [ -e \"$sha_file\" ]; then\n arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n run_clair_on_arch \"$arch\"\n fi\n done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_OCI_ATTACH_REPORT", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705", "name": "oci-attach-report", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n echo 'OCI attach report skipped by parameter.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n echo 'No Clair reports generated. Skipping upload.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n report_file=\"$1\"\n arch=\"${report_file/*-}\"\n echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n image_ref=\"${repository}@${digest}\"\n echo \"Attaching $f to ${image_ref}\"\n if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n then\n echo \"Failed to attach ${f} to ${image_ref}\"\n exit 1\n fi\n # shellcheck disable=SC2016\n reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d", "name": "conftest-vulnerabilities", "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n if [ ! -s \"$file\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n else\n /usr/bin/conftest test --no-fail $file \\\n --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n fi\n\n #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n result=$(jq -rce \\\n '{\n vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n },\n unpatched_vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n }\n }' \"$file\")\n\n scan_result=$(jq -s -rce \\\n '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } } } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/tree/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/commit_sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/target_branch": "base-zulcdf", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-zulcdf", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yrwtry", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/log-url": "https://44.253.176.196:9443/ns/build-e2e-uiwy/pipelinerun/gl-test-custom-branch-lqwehi-on-push-s7wz6", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-zulcdf\"", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-test-custom-branch-lqwehi' into 'base-zulcdf'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/commit/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-zulcdf", "pipelinesascode.tekton.dev/source-project-id": "82120572", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/target-project-id": "82120572", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4/records/1912ba47-df82-480a-ada2-19bbf7582ec2", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-ehvmll\",\"commit\":\"0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, appstudio" }, "creationTimestamp": "2026-05-12T09:51:17Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-05-12T09:52:16Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-socu", "appstudio.openshift.io/component": "gl-test-custom-branch-lqwehi", "build.appstudio.redhat.com/build_type": "docker", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRun": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRunUID": "6ecf52c9-d967-4f2c-a1a1-792b582262c4", "tekton.dev/pipelineTask": "push-dockerfile", "tekton.dev/task": "push-dockerfile-oci-ta" }, "name": "gl-test-custom-branch-lqwehi-on-push-s7wz6-push-dockerfile", "namespace": "build-e2e-uiwy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "uid": "6ecf52c9-d967-4f2c-a1a1-792b582262c4" } ], "resourceVersion": "26453", "uid": "1912ba47-df82-480a-ada2-19bbf7582ec2" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" }, { "name": "IMAGE_DIGEST", "value": "sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3" }, { "name": "DOCKERFILE", "value": "docker/Dockerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi@sha256:d34a96261c3bc247582e0e02204acc3a1d827d9cb568601b2be214031e2219d9" } ], "serviceAccountName": "build-pipeline-gl-test-custom-branch-lqwehi", "taskRef": { "params": [ { "name": "name", "value": "push-dockerfile-oci-ta" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-12T09:51:38Z", "conditions": [ { "lastTransitionTime": "2026-05-12T09:51:38Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-test-custom-branch-lqwehi-on-push-s7wz6-push-dockerfile-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7855471abfe87de080b914f2f3ca27c59e64f6448a7c2435e51435b764494c71" }, "entryPoint": "push-dockerfile-oci-ta", "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta" } }, "results": [ { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi@sha256:fc06f96f7078ce9688745885f71de5db5d4e9977d201f886ca33e5bf61f071de" } ], "startTime": "2026-05-12T09:51:21Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://e482acda250aefbf4692c3b6ca0656e468bd8f04f56db56b3f2117074a937c8d", "exitCode": 0, "finishedAt": "2026-05-12T09:51:36Z", "reason": "Completed", "startedAt": "2026-05-12T09:51:36Z" }, "terminationReason": "Completed" }, { "container": "step-push", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "push", "provenance": {}, "terminated": { "containerID": "containerd://9da6be0d7070c047e0cb5350fc8655293ed1add73ca01f3e4c4683be8cbc5611", "exitCode": 0, "finishedAt": "2026-05-12T09:51:38Z", "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi@sha256:fc06f96f7078ce9688745885f71de5db5d4e9977d201f886ca33e5bf61f071de\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-12T09:51:37Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.", "params": [ { "default": "application/vnd.konflux.dockerfile", "description": "Artifact type of the Dockerfile image.", "name": "ARTIFACT_TYPE", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile.", "name": "DOCKERFILE", "type": "string" }, { "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.", "name": "IMAGE", "type": "string" }, { "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "info", "description": "Log level to use in the task. See golang logrus docs for available levels.", "name": "LOG_LEVEL", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".dockerfile", "description": "Suffix of the Dockerfile image tag.", "name": "TAG_SUFFIX", "type": "string" } ], "results": [ { "description": "Digest-pinned image reference to the Dockerfile image.", "name": "IMAGE_REF", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi@sha256:d34a96261c3bc247582e0e02204acc3a1d827d9cb568601b2be214031e2219d9=/var/workdir/source" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "args": [ "--source", "source", "--context", ".", "--containerfile", "docker/Dockerfile", "--image-url", "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "--image-digest", "sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3", "--artifact-type", "application/vnd.konflux.dockerfile", "--tag-suffix", ".dockerfile", "--result-path-image-ref", "/tekton/results/IMAGE_REF", "--alternative-filename", "Dockerfile" ], "command": [ "konflux-build-cli", "image", "push-containerfile" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "push", "workingDir": "/var/workdir" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/tree/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/commit_sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/target_branch": "base-zulcdf", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-zulcdf", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yrwtry", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/log-url": "https://44.253.176.196:9443/ns/build-e2e-uiwy/pipelinerun/gl-test-custom-branch-lqwehi-on-push-s7wz6", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-zulcdf\"", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-test-custom-branch-lqwehi' into 'base-zulcdf'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/commit/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-zulcdf", "pipelinesascode.tekton.dev/source-project-id": "82120572", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/target-project-id": "82120572", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4/records/1bfc06b8-9f19-4cde-967c-fe9fa51627bb", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-ehvmll\",\"commit\":\"0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4", "results.tekton.dev/stored": "true" }, "creationTimestamp": "2026-05-12T09:51:18Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-05-12T09:52:16Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-socu", "appstudio.openshift.io/component": "gl-test-custom-branch-lqwehi", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRun": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRunUID": "6ecf52c9-d967-4f2c-a1a1-792b582262c4", "tekton.dev/pipelineTask": "rpms-signature-scan", "tekton.dev/task": "rpms-signature-scan" }, "name": "gl-test-custom-branch-lqwehi-on-push-s7wz6-rpms-signature-scan", "namespace": "build-e2e-uiwy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "uid": "6ecf52c9-d967-4f2c-a1a1-792b582262c4" } ], "resourceVersion": "26454", "uid": "1bfc06b8-9f19-4cde-967c-fe9fa51627bb" }, "spec": { "params": [ { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" }, { "name": "image-digest", "value": "sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3" } ], "serviceAccountName": "build-pipeline-gl-test-custom-branch-lqwehi", "taskRef": { "params": [ { "name": "name", "value": "rpms-signature-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-12T09:51:48Z", "conditions": [ { "lastTransitionTime": "2026-05-12T09:51:48Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-test-custom-branch-lqwehd454025752af667ed65f471154538b8b-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20" }, "entryPoint": "rpms-signature-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\", \"digests\": [\"sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3\"]}}\n" }, { "name": "RPMS_DATA", "type": "string", "value": "{\"keys\": {\"unsigned\": 0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-12T09:51:46+00:00\",\"note\":\"Task rpms-signature-scan completed successfully\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "startTime": "2026-05-12T09:51:22Z", "steps": [ { "container": "step-rpms-signature-scan", "imageID": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f", "name": "rpms-signature-scan", "provenance": {}, "terminated": { "containerID": "containerd://867883a2e279e691a26864c95daf75090ae4d1eed01ed4346842cfee20bf36a6", "exitCode": 0, "finishedAt": "2026-05-12T09:51:46Z", "reason": "Completed", "startedAt": "2026-05-12T09:51:39Z" }, "terminationReason": "Completed" }, { "container": "step-output-results", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "provenance": {}, "terminated": { "containerID": "containerd://17b5a9cfe01bc99fa8d90e71a73950e158c18cd15fa91ffe84b05cc66cbec710", "exitCode": 0, "finishedAt": "2026-05-12T09:51:47Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\\\", \\\"digests\\\": [\\\"sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3\\\"]}}\\n\",\"type\":1},{\"key\":\"RPMS_DATA\",\"value\":\"{\\\"keys\\\": {\\\"unsigned\\\": 0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-12T09:51:46+00:00\\\",\\\"note\\\":\\\"Task rpms-signature-scan completed successfully\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-12T09:51:46Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans RPMs in an image and provide information about RPMs signatures.", "params": [ { "description": "Image URL", "name": "image-url", "type": "string" }, { "description": "Image digest to scan", "name": "image-digest", "type": "string" }, { "default": "/tmp", "description": "Directory that will be used for storing temporary\nfiles produced by this task.\n", "name": "workdir", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Information about signed and unsigned RPMs", "name": "RPMS_DATA", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "200m", "memory": "256Mi" }, "requests": { "cpu": "200m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" }, { "name": "IMAGE_DIGEST", "value": "sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3" }, { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/tools@sha256:b78a949c4a986724ae8e768ca315fc35bae5e0553de5cd2edd468d6a7d4b7e0f", "name": "rpms-signature-scan", "script": "#!/bin/bash\nset -ex\nset -o pipefail\n\nrpm_verifier \\\n --image-url \"${IMAGE_URL}\" \\\n --image-digest \"${IMAGE_DIGEST}\" \\\n --workdir \"${WORKDIR}\" \\\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "cpu": "50m", "memory": "32Mi" }, "requests": { "cpu": "50m", "memory": "32Mi" } }, "env": [ { "name": "WORKDIR", "value": "/tmp" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "output-results", "script": "#!/bin/bash\nset -ex\n\nsource /utils.sh\nstatus=$(cat \"${WORKDIR}\"/status)\nrpms_data=$(cat \"${WORKDIR}\"/results)\nimages_processed=$(cat \"${WORKDIR}\"/images_processed)\n\nif [ \"$status\" == \"ERROR\" ]; then\n note=\"Task rpms-signature-scan failed to scan images. Refer to Tekton task output for details\"\nelse\n note=\"Task rpms-signature-scan completed successfully\"\nfi\n\nTEST_OUTPUT=$(make_result_json -r \"$status\" -t \"$note\")\n\necho \"${TEST_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\necho \"${rpms_data}\" | tee \"/tekton/results/RPMS_DATA\"\necho \"${images_processed}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/tmp", "name": "workdir" } ] } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/tree/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/commit_sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/target_branch": "base-zulcdf", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-zulcdf", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yrwtry", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/log-url": "https://44.253.176.196:9443/ns/build-e2e-uiwy/pipelinerun/gl-test-custom-branch-lqwehi-on-push-s7wz6", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-zulcdf\"", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-test-custom-branch-lqwehi' into 'base-zulcdf'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/commit/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-zulcdf", "pipelinesascode.tekton.dev/source-project-id": "82120572", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/target-project-id": "82120572", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4/records/85507e53-ba54-4dd0-843e-4c8d8e3af188", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-ehvmll\",\"commit\":\"0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux" }, "creationTimestamp": "2026-05-12T09:51:17Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-05-12T09:52:16Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-socu", "appstudio.openshift.io/component": "gl-test-custom-branch-lqwehi", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRun": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRunUID": "6ecf52c9-d967-4f2c-a1a1-792b582262c4", "tekton.dev/pipelineTask": "sast-unicode-check", "tekton.dev/task": "sast-unicode-check-oci-ta" }, "name": "gl-test-custom-branch-lqwehi-on-push-s7wz6-sast-unicode-check", "namespace": "build-e2e-uiwy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "uid": "6ecf52c9-d967-4f2c-a1a1-792b582262c4" } ], "resourceVersion": "26461", "uid": "85507e53-ba54-4dd0-843e-4c8d8e3af188" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi@sha256:d34a96261c3bc247582e0e02204acc3a1d827d9cb568601b2be214031e2219d9" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "serviceAccountName": "build-pipeline-gl-test-custom-branch-lqwehi", "taskRef": { "params": [ { "name": "name", "value": "sast-unicode-check-oci-ta" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-12T09:51:41Z", "conditions": [ { "lastTransitionTime": "2026-05-12T09:51:41Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-test-custom-branch-lqwehae15dfa15f63c65c044488ef9a5ad9d5-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "90efa582de7770d55102b74014a765cd16a25a56f2cf644b56a788c70c4dc749" }, "entryPoint": "sast-unicode-check-oci-ta", "uri": "quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-12T09:51:39+00:00\",\"note\":\"Task sast-unicode-check-oci-ta success: No finding was detected\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "startTime": "2026-05-12T09:51:19Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://147cec7639074f47fe5ba68c1e32cf4db16eac461a90cb855126a539ad450ac2", "exitCode": 0, "finishedAt": "2026-05-12T09:51:37Z", "reason": "Completed", "startedAt": "2026-05-12T09:51:36Z" }, "terminationReason": "Completed" }, { "container": "step-sast-unicode-check", "imageID": "quay.io/konflux-ci/konflux-test@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-unicode-check", "provenance": {}, "terminated": { "containerID": "containerd://513272eca6cd14119deba9add6e1f546564d06be49ca868acf2b7ac42789b0c6", "exitCode": 0, "finishedAt": "2026-05-12T09:51:39Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-12T09:51:39+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-12T09:51:38Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "provenance": {}, "terminated": { "containerID": "containerd://68adfda9c6c301a7a9b225add3f1eeb54d2d6949cbda82f2cbe9bffcfc992bd0", "exitCode": 0, "finishedAt": "2026-05-12T09:51:40Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-12T09:51:39+00:00\\\",\\\"note\\\":\\\"Task sast-unicode-check-oci-ta success: No finding was detected\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-12T09:51:39Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans source code for non-printable unicode characters in all text files.", "params": [ { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "-p bidi -v -d -t", "description": "arguments for find-unicode-control command.", "name": "FIND_UNICODE_CONTROL_ARGS", "type": "string" }, { "default": "SITE_DEFAULT", "description": "Known False Positives (KFP) git URL (optionally taking a revision delimited by \\#). Defaults to \"SITE_DEFAULT\", which means the default value \"https://gitlab.cee.redhat.com/osh/known-false-positives.git\" for internal Konflux instance and empty string for external Konflux instance. If set to an empty string, the KFP filtering is disabled.", "name": "KFP_GIT_URL", "type": "string" }, { "default": "", "description": "Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.", "name": "PROJECT_NAME", "type": "string" }, { "default": "false", "description": "Whether to record the excluded findings (defaults to false).\nIf `true`, the excluded findings will be stored in `excluded-findings.json`.\n", "name": "RECORD_EXCLUDED", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": ".", "description": "Target directories in component's source code. Multiple values should be separated with commas.", "name": "TARGET_DIRS", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "description": "Image digest used for ORAS upload.", "name": "image-digest", "type": "string" }, { "description": "Image URL used for ORAS upload.", "name": "image-url", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi@sha256:d34a96261c3bc247582e0e02204acc3a1d827d9cb568601b2be214031e2219d9=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": { "limits": { "memory": "4Gi" }, "requests": { "memory": "4Gi" } }, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:d6d6048bdb5a73697ff88734a3f33c54193405b901d3f5192b8251a878623906", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "computeResources": { "limits": { "memory": "4Gi" }, "requests": { "cpu": "100m", "memory": "4Gi" } }, "env": [ { "name": "KFP_GIT_URL", "value": "SITE_DEFAULT" }, { "name": "PROJECT_NAME" }, { "name": "FIND_UNICODE_CONTROL_ARGS", "value": "-p bidi -v -d -t" }, { "name": "RECORD_EXCLUDED", "value": "false" }, { "name": "TARGET_DIRS", "value": "." }, { "name": "SOURCE_CODE_DIR", "value": "/var/workdir" }, { "name": "COMPONENT_LABEL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.labels['appstudio.openshift.io/component']" } } }, { "name": "BUILD_PLR_LOG_URL", "valueFrom": { "fieldRef": { "fieldPath": "metadata.annotations['pipelinesascode.tekton.dev/log-url']" } } } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "sast-unicode-check", "script": "#!/usr/bin/env bash\nset -exuo pipefail\n\n# shellcheck source=/dev/null\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nif [[ -z \"${PROJECT_NAME}\" ]]; then\n PROJECT_NAME=${COMPONENT_LABEL}\nfi\n\necho \"INFO: The PROJECT_NAME used is: ${PROJECT_NAME}\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSCAN_PROP=\"https://github.com/siddhesh/find-unicode-control.git#c2accbfbba7553a8bc1ebd97089ae08ad8347e58\"\nFUC_EXIT_CODE=0\n\n# generate full path for each dirname separated by comma\ndeclare -a ALL_TARGETS\nOLD_IFS=\"$IFS\"\nIFS=\",\"\nfor d in $TARGET_DIRS; do\n ALL_TARGETS+=(\"${SOURCE_CODE_DIR}/source/${d}\")\ndone\nIFS=\"$OLD_IFS\"\n\n# shellcheck disable=SC2086\nLANG=en_US.utf8 find_unicode_control.py ${FIND_UNICODE_CONTROL_ARGS} \"${ALL_TARGETS[@]}\" \\\n \u003eraw_sast_unicode_check_out.txt \\\n 2\u003eraw_sast_unicode_check_out.log ||\n FUC_EXIT_CODE=$?\nif [[ \"${FUC_EXIT_CODE}\" -ne 0 ]] \u0026\u0026 [[ \"${FUC_EXIT_CODE}\" -ne 1 ]]; then\n echo \"Failed to run find-unicode-control command\" \u003e\u00262\n cat raw_sast_unicode_check_out.log\n note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Translate the output format\nif ! sed -i raw_sast_unicode_check_out.txt -E -e 's|(.*:[0-9]+)(.*)|\\1: warning:\\2|' -e 's|^|Error: UNICONTROL_WARNING:\\n|'; then\n echo \"Error: failed to translate the unicontrol output format\" \u003e\u00262\n note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\n# Process all results as configured with CSGERP_OPTS\nCSGERP_OPTS=(\n --mode=json\n --remove-duplicates\n --embed-context=3\n --set-scan-prop=\"${SCAN_PROP}\"\n --strip-path-prefix=\"${SOURCE_CODE_DIR}\"/source/\n)\n# In order to generate csdiff/v1, we need to add the whole path of the source code as\n# sast-unicode-check only provides an URI to embed the context\nif ! csgrep \"${CSGERP_OPTS[@]}\" raw_sast_unicode_check_out.txt \u003eprocessed_sast_unicode_check_out.json 2\u003eprocessed_sast_unicode_check_out.err; then\n echo \"Error occurred while running csgrep with CSGERP_OPTS:\"\n cat processed_sast_unicode_check_out.err\n note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 1\nfi\n\ncsgrep --mode=evtstat processed_sast_unicode_check_out.json\n\nif [[ \"${KFP_GIT_URL}\" == \"SITE_DEFAULT\" ]]; then\n KFP_GIT_URL=\"https://gitlab.cee.redhat.com/osh/known-false-positives.git\"\nfi\nPROBE_URL=\"${KFP_GIT_URL%.git}\" # trims '.git' suffix\n\n# create the KFP clone directory regardless\nKFP_DIR=\"known-false-positives\"\nKFP_CLONED=\"0\"\nmkdir \"${KFP_DIR}\"\n\n# We check if the KFP_GIT_URL variable is set to clone and apply the filters or not\nif [[ -n \"${KFP_GIT_URL}\" ]]; then\n # Default location only reachable from internal Konflux instances, check reachable first\n echo -n \"INFO: Probing ${PROBE_URL}... \"\n if curl --fail --head --max-time 60 --no-progress-meter \"${PROBE_URL}\" \u003e \u003e(head -1); then\n echo \"INFO: Trying to clone known-false-positives..\"\n git clone \"${KFP_GIT_URL}\" \"${KFP_DIR}\" \u0026\u0026 KFP_CLONED=\"1\"\n fi\nfi\n\n# If KFP clone failed, use the unfiltered results\nif [[ \"${KFP_CLONED}\" -eq \"0\" ]]; then\n echo \"WARN: Failed to clone known-false-positives at ${KFP_GIT_URL}, scan results will not be filtered\"\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\nelse\n echo \"INFO: Filtering false positives in results files using csfilter-kfp...\"\n\n # Build initial csfilter-kfp command\n csfilter_kfp_cmd=(\n csfilter-kfp\n --verbose\n --kfp-dir=\"${KFP_DIR}\"\n --project-nvr=\"${PROJECT_NAME}\"\n )\n\n # Append --record-excluded option if RECORD_EXCLUDED is true\n if [[ \"${RECORD_EXCLUDED}\" == \"true\" ]]; then\n csfilter_kfp_cmd+=(--record-excluded=\"excluded-findings.json\")\n fi\n\n # Execute the command and capture any errors\n set +e\n \"${csfilter_kfp_cmd[@]}\" processed_sast_unicode_check_out.json \u003esast_unicode_check_out.json 2\u003esast_unicode_check_out.error\n status=$?\n set -e\n if [ \"$status\" -ne 0 ]; then\n echo \"WARN: failed to filter known false positives\" \u003e\u00262\n mv processed_sast_unicode_check_out.json sast_unicode_check_out.json\n else\n echo \"INFO: Succeeded filtering known false positives\" \u003e\u00262\n fi\nfi\n\n# Generate sarif report\ncsgrep --mode=sarif sast_unicode_check_out.json \u003esast_unicode_check_out.sarif\nif [[ \"${FUC_EXIT_CODE}\" -eq 0 ]]; then\n note=\"Task sast-unicode-check-oci-ta success: No finding was detected\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelif [[ \"${FUC_EXIT_CODE}\" -eq 1 ]] \u0026\u0026 [[ ! -s sast_unicode_check_out.sarif ]]; then\n note=\"Task sast-unicode-check-oci-ta success: Some findings were detected, but filtered by known false positive\"\n ERROR_OUTPUT=$(make_result_json -r SUCCESS -t \"$note\")\nelse\n echo \"sast-unicode-check test failed because of the following issues:\"\n cat sast_unicode_check_out.json\n TEST_OUTPUT=\n parse_test_output \"sast-unicode-check-oci-ta\" sarif sast_unicode_check_out.sarif || true\n note=\"Task sast-unicode-check-oci-ta failed: For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r ERROR -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n", "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ], "workingDir": "/var/workdir/source" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" }, { "name": "IMAGE_DIGEST", "value": "sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:da693a7dcbadafc9f4422ae6600b41b2847944f7f14c5622827d6f58c727cf08", "name": "upload", "script": "#!/usr/bin/env bash\n\nif [ -z \"${IMAGE_URL}\" ]; then\n echo 'No image-url param provided. Skipping upload.'\n exit 0\nfi\n\nUPLOAD_FILES=\"sast_unicode_check_out.sarif excluded-findings.json\"\nfor UPLOAD_FILE in ${UPLOAD_FILES}; do\n if [ ! -f \"${UPLOAD_FILE}\" ]; then\n echo \"No ${UPLOAD_FILE} exists. Skipping upload.\"\n continue\n fi\n\n if [ \"${UPLOAD_FILE}\" == \"excluded-findings.json\" ]; then\n MEDIA_TYPE=application/json\n else\n MEDIA_TYPE=application/sarif+json\n fi\n\n echo \"Selecting auth\"\n select-oci-auth \"${IMAGE_URL}\" \u003e\"${HOME}/auth.json\"\n echo \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${UPLOAD_FILE}:${MEDIA_TYPE}\"\ndone\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/tree/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/commit_sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "build.appstudio.redhat.com/target_branch": "base-zulcdf", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-zulcdf", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-yrwtry", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/log-url": "https://44.253.176.196:9443/ns/build-e2e-uiwy/pipelinerun/gl-test-custom-branch-lqwehi-on-push-s7wz6", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-zulcdf\"", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/sha-title": "Merge branch 'konflux-gl-test-custom-branch-lqwehi' into 'base-zulcdf'", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll/-/commit/0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-zulcdf", "pipelinesascode.tekton.dev/source-project-id": "82120572", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/target-project-id": "82120572", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4/records/68e9e2f3-7e70-4690-b0ff-bf13d079ef72", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-ehvmll\",\"commit\":\"0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-uiwy/results/6ecf52c9-d967-4f2c-a1a1-792b582262c4", "results.tekton.dev/stored": "true" }, "creationTimestamp": "2026-05-12T09:51:17Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-05-12T09:52:16Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-socu", "appstudio.openshift.io/component": "gl-test-custom-branch-lqwehi", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-lqwehi-on-push", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ehvmll", "pipelinesascode.tekton.dev/sha": "0e59ec67ac53c7bf0a1f43d128774c8a80b4937a", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ehvmll", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRun": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "tekton.dev/pipelineRunUID": "6ecf52c9-d967-4f2c-a1a1-792b582262c4", "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks", "tekton.dev/task": "ecosystem-cert-preflight-checks" }, "name": "gl-test-custom-branch-lqwehi-on4c0eeba250933e2243a8c112c5473668", "namespace": "build-e2e-uiwy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-test-custom-branch-lqwehi-on-push-s7wz6", "uid": "6ecf52c9-d967-4f2c-a1a1-792b582262c4" } ], "resourceVersion": "26483", "uid": "68e9e2f3-7e70-4690-b0ff-bf13d079ef72" }, "spec": { "params": [ { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" } ], "serviceAccountName": "build-pipeline-gl-test-custom-branch-lqwehi", "taskRef": { "params": [ { "name": "name", "value": "ecosystem-cert-preflight-checks" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-12T09:51:51Z", "conditions": [ { "lastTransitionTime": "2026-05-12T09:51:51Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-test-custom-branch-lqweh77a0efdffec4250bc7edfc94f48a8e10-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850" }, "entryPoint": "ecosystem-cert-preflight-checks", "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks" } }, "results": [ { "name": "ARTIFACT_TYPE", "type": "string", "value": "application" }, { "name": "ARTIFACT_TYPE_SET_BY", "type": "string", "value": "introspection" }, { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\", \"digests\": [\"sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3\"]}}" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778579509\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":4,\"failures\":3,\"warnings\":0}" } ], "startTime": "2026-05-12T09:51:18Z", "steps": [ { "container": "step-introspect", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "introspect", "provenance": {}, "results": [ { "name": "artifact-type", "type": "string", "value": "application" }, { "name": "artifact-type-set-by", "type": "string", "value": "introspection" } ], "terminated": { "containerID": "containerd://8e417455e77758e03a6d299cbde8e47195a9e25c4b152fdf8639a2d1f61fbce4", "exitCode": 0, "finishedAt": "2026-05-12T09:51:39Z", "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]", "reason": "Completed", "startedAt": "2026-05-12T09:51:37Z" }, "terminationReason": "Completed" }, { "container": "step-generate-container-auth", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "generate-container-auth", "provenance": {}, "results": [ { "name": "auth-json-path", "type": "string", "value": "/auth/auth.json" } ], "terminated": { "containerID": "containerd://9ab8830561e0e02cb7ad77e2be9153a2bc1b2ddba12be704ae268feb14738793", "exitCode": 0, "finishedAt": "2026-05-12T09:51:40Z", "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]", "reason": "Completed", "startedAt": "2026-05-12T09:51:40Z" }, "terminationReason": "Completed" }, { "container": "step-set-skip-for-bundles", "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1", "name": "set-skip-for-bundles", "provenance": {}, "terminated": { "containerID": "containerd://588ace05a079010fe038b5a73fab4e66a634cd1298c7b5545bf727a0c95ad5ab", "exitCode": 0, "finishedAt": "2026-05-12T09:51:41Z", "reason": "Completed", "startedAt": "2026-05-12T09:51:41Z" }, "terminationReason": "Skipped" }, { "container": "step-app-check", "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1", "name": "app-check", "provenance": {}, "terminated": { "containerID": "containerd://30503904ae7d9437bab72a7fb143c1b71db4cb6ff486392e774ef6a5014562c5", "exitCode": 0, "finishedAt": "2026-05-12T09:51:48Z", "reason": "Completed", "startedAt": "2026-05-12T09:51:41Z" }, "terminationReason": "Completed" }, { "container": "step-app-set-outcome", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "app-set-outcome", "provenance": {}, "results": [ { "name": "images-processed", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\", \"digests\": [\"sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3\"]}}" }, { "name": "test-output", "type": "string", "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778579509\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":4,\"failures\":3,\"warnings\":0}" } ], "terminated": { "containerID": "containerd://661be230a1f76a947282c0b704fc73f4581495c78d1a1a97a9ef24287fcc70e6", "exitCode": 0, "finishedAt": "2026-05-12T09:51:50Z", "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a\\\", \\\"digests\\\": [\\\"sha256:6f1b76a6a09be82a0325ccea07541c6f6d61c13f6a88767e5666fde5d7d5e2c3\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778579509\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":4,\\\"failures\\\":3,\\\"warnings\\\":0}\",\"type\":4}]", "reason": "Completed", "startedAt": "2026-05-12T09:51:49Z" }, "terminationReason": "Completed" }, { "container": "step-final-outcome", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "final-outcome", "provenance": {}, "results": [ { "name": "test-output", "type": "string", "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778579509\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":4,\"failures\":3,\"warnings\":0}" } ], "terminated": { "containerID": "containerd://f6ddfc404e3a24046361fa3daa23392a9c54d2daab36fa3f6be5bb490f770bab", "exitCode": 0, "finishedAt": "2026-05-12T09:51:50Z", "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778579509\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":4,\\\"failures\\\":3,\\\"warnings\\\":0}\",\"type\":4}]", "reason": "Completed", "startedAt": "2026-05-12T09:51:50Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.", "params": [ { "description": "Image url to scan.", "name": "image-url", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "introspect", "description": "The type of artifact. Select from application, operatorbundle, or introspect.", "name": "artifact-type", "type": "string" }, { "default": "", "description": "The platform the image is built on.", "name": "platform", "type": "string" } ], "results": [ { "description": "Ecosystem checks pass or fail outcome.", "name": "TEST_OUTPUT", "type": "string", "value": "$(steps.final-outcome.results.test-output)" }, { "description": "The artifact type, either introspected or set.", "name": "ARTIFACT_TYPE", "type": "string", "value": "$(steps.introspect.results.artifact-type)" }, { "description": "How the artifact type was set.", "name": "ARTIFACT_TYPE_SET_BY", "type": "string", "value": "$(steps.introspect.results.artifact-type-set-by)" }, { "description": "Collected image digests", "name": "IMAGES_PROCESSED", "type": "string", "value": "$(steps.app-set-outcome.results.images-processed)" } ], "steps": [ { "computeResources": { "limits": { "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "env": [ { "name": "PARAM_ARTIFACT_TYPE", "value": "introspect" }, { "name": "PARAM_IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "introspect", "results": [ { "description": "The type of artifact this task is considering.", "name": "artifact-type" }, { "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n", "name": "artifact-type-set-by" } ], "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n echo \"Artifact type will be determined by introspection.\"\n _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n # short circuit if the artifact type was set via parameter.\n echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n _CURRENT_ARCH=$(uname -m)\n _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n # to map them.\n case ${_CURRENT_ARCH} in\n \"aarch64\")\n _CURRENT_ARCH=\"arm64\"\n ;;\n \"x86_64\")\n _CURRENT_ARCH=\"amd64\"\n ;;\n *)\n ;;\n esac\n\n # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n else\n # If there is no image for the current OS and architecture, just use the first one in the list.\n _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n | jq '.Labels | keys | .[]' -r \\\n | { grep operators.operatorframework.io.bundle || true ;} \\\n | tee /tmp/ecosystem-image-labels\nthen\n echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n" }, { "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "50m", "memory": "64Mi" } }, "env": [ { "name": "PARAM_IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "generate-container-auth", "results": [ { "description": "Path to auth.json", "name": "auth-json-path" } ], "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n", "volumeMounts": [ { "mountPath": "/auth", "name": "auth" } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1", "name": "set-skip-for-bundles", "results": [ { "description": "A skipped tekton result for bundles.", "name": "test-output" } ], "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n", "volumeMounts": [ { "mountPath": "/bundle", "name": "pfltoutputdir" } ], "when": [ { "input": "$(steps.introspect.results.artifact-type)", "operator": "in", "values": [ "operatorbundle" ] } ] }, { "computeResources": { "limits": { "memory": "4Gi" }, "requests": { "cpu": "1", "memory": "4Gi" } }, "env": [ { "name": "PFLT_DOCKERCONFIG", "value": "$(steps.generate-container-auth.results.auth-json-path)" }, { "name": "PFLT_KONFLUX", "value": "true" }, { "name": "PARAM_IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" }, { "name": "PARAM_PLATFORM" } ], "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1", "name": "app-check", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n # Extract part after slash if present\n arch=\"${platform#*/}\"\n if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n arch=\"amd64\"\n fi\n\n # Validate against supported arch list. If it's not a known arch, return an error result\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n exit 0\n ;;\n esac\n\n /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n /usr/local/bin/preflight check container \"$image_url\"\nfi\n", "volumeMounts": [ { "mountPath": "/artifacts", "name": "pfltoutputdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" }, { "mountPath": "/auth", "name": "auth", "readOnly": true } ], "when": [ { "input": "$(steps.introspect.results.artifact-type)", "operator": "in", "values": [ "application" ] } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "PARAM_IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-uiwy/gl-test-custom-branch-lqwehi:0e59ec67ac53c7bf0a1f43d128774c8a80b4937a" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "app-set-outcome", "results": [ { "description": "The overall outcome of this task.", "name": "test-output" }, { "description": "Processed image digests.", "name": "images-processed" } ], "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n # Check if results directory exits\n RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n continue\n fi\n # Process results\n if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{ result: $result,\n timestamp: $date,\n note: $note,\n successes: $successes|tonumber,\n failures: $failures|tonumber,\n warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n", "volumeMounts": [ { "mountPath": "/artifacts", "name": "pfltoutputdir" } ], "when": [ { "input": "$(steps.introspect.results.artifact-type)", "operator": "in", "values": [ "application" ] } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "final-outcome", "results": [ { "name": "test-output" } ], "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n", "volumeMounts": [ { "mountPath": "/mount", "name": "pfltoutputdir" } ] } ], "volumes": [ { "emptyDir": {}, "name": "pfltoutputdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "auth" } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }