{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/sample-multi-component?rev=585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "build.appstudio.redhat.com/commit_sha": "585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "build.appstudio.redhat.com/pull_request_number": "34045", "build.appstudio.redhat.com/target_branch": "multi-component-base-lqwvpp", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "multi-component-base-lqwvpp", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "86200413253", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-sgbess", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-kapy/pipelinerun/go-component-xehdbs-on-pull-request-6sqhb", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-base-lqwvpp\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-xehdbs-pull-request.yaml\".pathChanged() )", "pipelinesascode.tekton.dev/original-prname": "go-component-xehdbs-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34045", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "redhat-appstudio-qe-bot", "pipelinesascode.tekton.dev/sha": "585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/sample-multi-component/commit/585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "pipelinesascode.tekton.dev/source-branch": "pr-branch-ioinde", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-kapy/results/e3d2a85f-786e-4fb5-9884-02c4f9cc8867/records/795c02f4-3f7d-4c68-8683-b33db1a34e2a", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"sample-multi-component\",\"commit\":\"585eac1e978b7d089e9c677cf9c0cb4381e52d4d\",\"eventType\":\"pull_request\",\"pull_request-id\":34045}", "results.tekton.dev/result": "build-e2e-kapy/results/e3d2a85f-786e-4fb5-9884-02c4f9cc8867", "results.tekton.dev/stored": "true", "tekton.dev/categories": "Git", "tekton.dev/displayName": "git clone oci trusted artifacts", "tekton.dev/pipelines.minVersion": "0.21.0", "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64", "tekton.dev/tags": "git", "test.appstudio.openshift.io/pr-group": "pr-branch-ioinde" }, "creationTimestamp": "2026-07-09T18:44:25Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-09T18:44:59Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-positive-mc-xjfw", "appstudio.openshift.io/component": "go-component-xehdbs", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "86200413253", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "go-component-xehdbs-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34045", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/sha": "585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "go-component-xehdbs-on-pull-request-6sqhb", "tekton.dev/pipelineRun": "go-component-xehdbs-on-pull-request-6sqhb", "tekton.dev/pipelineRunUID": "e3d2a85f-786e-4fb5-9884-02c4f9cc8867", "tekton.dev/pipelineTask": "clone-repository", "tekton.dev/task": "git-clone-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "91a96d28753a80f1820d87e1904cfee097d5c47847b6408d097b1d63436925" }, "name": "go-component-xehdbs-on-pull-request-6sqhb-clone-repository", "namespace": "build-e2e-kapy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "go-component-xehdbs-on-pull-request-6sqhb", "uid": "e3d2a85f-786e-4fb5-9884-02c4f9cc8867" } ], "resourceVersion": "35917", "uid": "795c02f4-3f7d-4c68-8683-b33db1a34e2a" }, "spec": { "params": [ { "name": "url", "value": "https://github.com/redhat-appstudio-qe/sample-multi-component" }, { "name": "revision", "value": "585eac1e978b7d089e9c677cf9c0cb4381e52d4d" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-kapy/go-component-xehdbs:on-pr-585eac1e978b7d089e9c677cf9c0cb4381e52d4d.git" }, { "name": "ociArtifactExpiresAfter", "value": "5d" } ], "serviceAccountName": "build-pipeline-go-component-xehdbs", "taskRef": { "params": [ { "name": "name", "value": "git-clone-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s", "workspaces": [ { "name": "basic-auth", "secret": { "secretName": "pac-gitauth-sgbess" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-07-09T18:44:33Z", "conditions": [ { "lastTransitionTime": "2026-07-09T18:44:33Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "go-component-xehdbs-on-pull-request-6sqhb-clone-repository-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, "entryPoint": "git-clone-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min" } }, "results": [ { "name": "CHAINS-GIT_COMMIT", "type": "string", "value": "585eac1e978b7d089e9c677cf9c0cb4381e52d4d" }, { "name": "CHAINS-GIT_URL", "type": "string", "value": "https://github.com/redhat-appstudio-qe/sample-multi-component" }, { "name": "commit", "type": "string", "value": "585eac1e978b7d089e9c677cf9c0cb4381e52d4d" }, { "name": "commit-timestamp", "type": "string", "value": "1783622652" }, { "name": "short-commit", "type": "string", "value": "585eac1" }, { "name": "url", "type": "string", "value": "https://github.com/redhat-appstudio-qe/sample-multi-component" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-kapy/go-component-xehdbs@sha256:95ec12ecc658310949ab70cc861350daee18e828060092c59501e58081c7d1fa" } ], "startTime": "2026-07-09T18:44:25Z", "steps": [ { "container": "step-clone", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "provenance": {}, "terminated": { "containerID": "containerd://c516d46c1e98929a911af0eec38ad7a127b958f2c0543524b2bb6b854b4c189b", "exitCode": 0, "finishedAt": "2026-07-09T18:44:29Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"585eac1e978b7d089e9c677cf9c0cb4381e52d4d\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/sample-multi-component\",\"type\":1},{\"key\":\"commit\",\"value\":\"585eac1e978b7d089e9c677cf9c0cb4381e52d4d\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1783622652\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"585eac1\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/sample-multi-component\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-09T18:44:29Z" }, "terminationReason": "Completed" }, { "container": "step-symlink-check", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "provenance": {}, "terminated": { "containerID": "containerd://6f98812326653e5cd2347ad9d4ecb86c7252923391b7cf96cf0e6a9bed7a4377", "exitCode": 0, "finishedAt": "2026-07-09T18:44:30Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"585eac1e978b7d089e9c677cf9c0cb4381e52d4d\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/sample-multi-component\",\"type\":1},{\"key\":\"commit\",\"value\":\"585eac1e978b7d089e9c677cf9c0cb4381e52d4d\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1783622652\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"585eac1\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/sample-multi-component\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-09T18:44:30Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://982e8979790b2a703f93ff3c90bfef4b197465aaf7a55c8781a0c714138bd789", "exitCode": 0, "finishedAt": "2026-07-09T18:44:32Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"585eac1e978b7d089e9c677cf9c0cb4381e52d4d\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/sample-multi-component\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-kapy/go-component-xehdbs@sha256:95ec12ecc658310949ab70cc861350daee18e828060092c59501e58081c7d1fa\",\"type\":1},{\"key\":\"commit\",\"value\":\"585eac1e978b7d089e9c677cf9c0cb4381e52d4d\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1783622652\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"585eac1\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/sample-multi-component\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-09T18:44:30Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.", "params": [ { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "1", "description": "Perform a shallow clone, fetching only the most recent N commits.", "name": "depth", "type": "string" }, { "default": "true", "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n", "name": "enableSymlinkCheck", "type": "string" }, { "default": "false", "description": "Fetch all tags for the repo.", "name": "fetchTags", "type": "string" }, { "default": "", "description": "HTTP proxy server for non-SSL requests.", "name": "httpProxy", "type": "string" }, { "default": "", "description": "HTTPS proxy server for SSL requests.", "name": "httpsProxy", "type": "string" }, { "default": "", "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n", "name": "mergeSourceDepth", "type": "string" }, { "default": "", "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n", "name": "mergeSourceRepoUrl", "type": "string" }, { "default": "false", "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.", "name": "mergeTargetBranch", "type": "string" }, { "default": "", "description": "Opt out of proxying HTTP/HTTPS requests.", "name": "noProxy", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "", "description": "Refspec to fetch before checking out revision.", "name": "refspec", "type": "string" }, { "default": "", "description": "Revision to checkout. (branch, tag, sha, ref, etc...)", "name": "revision", "type": "string" }, { "default": "7", "description": "Length of short commit SHA", "name": "shortCommitLength", "type": "string" }, { "default": "", "description": "Define the directory patterns to match or exclude when performing a sparse checkout.", "name": "sparseCheckoutDirectories", "type": "string" }, { "default": "true", "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.", "name": "sslVerify", "type": "string" }, { "default": "", "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n", "name": "submodulePaths", "type": "string" }, { "default": "true", "description": "Initialize and fetch git submodules.", "name": "submodules", "type": "string" }, { "default": "main", "description": "The target branch to merge into the revision (if mergeTargetBranch is true).", "name": "targetBranch", "type": "string" }, { "description": "Repository URL to clone from.", "name": "url", "type": "string" }, { "default": "/tekton/home", "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n", "name": "userHome", "type": "string" }, { "default": "false", "description": "Log the commands that are executed during `git-clone`'s operation.", "name": "verbose", "type": "string" } ], "results": [ { "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_COMMIT", "type": "string" }, { "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_URL", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "description": "The precise commit SHA that was fetched by this Task.", "name": "commit", "type": "string" }, { "description": "The commit timestamp of the checkout", "name": "commit-timestamp", "type": "string" }, { "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).", "name": "merged_sha", "type": "string" }, { "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters", "name": "short-commit", "type": "string" }, { "description": "The precise URL that was fetched by this Task.", "name": "url", "type": "string" } ], "steps": [ { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "PARAM_URL", "value": "https://github.com/redhat-appstudio-qe/sample-multi-component" }, { "name": "PARAM_REVISION", "value": "585eac1e978b7d089e9c677cf9c0cb4381e52d4d" }, { "name": "PARAM_REFSPEC" }, { "name": "PARAM_SUBMODULES", "value": "true" }, { "name": "PARAM_SUBMODULE_PATHS" }, { "name": "PARAM_DEPTH", "value": "1" }, { "name": "PARAM_SHORT_COMMIT_LENGTH", "value": "7" }, { "name": "PARAM_SSL_VERIFY", "value": "true" }, { "name": "PARAM_HTTP_PROXY" }, { "name": "PARAM_HTTPS_PROXY" }, { "name": "PARAM_NO_PROXY" }, { "name": "PARAM_VERBOSE", "value": "false" }, { "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES" }, { "name": "PARAM_USER_HOME", "value": "/tekton/home" }, { "name": "PARAM_FETCH_TAGS", "value": "false" }, { "name": "PARAM_MERGE_TARGET_BRANCH", "value": "false" }, { "name": "PARAM_TARGET_BRANCH", "value": "main" }, { "name": "PARAM_MERGE_SOURCE_REPO_URL" }, { "name": "PARAM_MERGE_SOURCE_DEPTH" }, { "name": "WORKSPACE_SSH_DIRECTORY_BOUND", "value": "false" }, { "name": "WORKSPACE_SSH_DIRECTORY_PATH" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND", "value": "true" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH", "value": "/workspace/basic-auth" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n # Compatibility with kubernetes.io/basic-auth secrets\n elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n else\n echo \"Unknown basic-auth workspace format\"\n exit 1\n fi\n chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n -url=\"${PARAM_URL}\" \\\n -revision=\"${PARAM_REVISION}\" \\\n -refspec=\"${PARAM_REFSPEC}\" \\\n -path=\"${CHECKOUT_DIR}\" \\\n -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n -submodules=\"${PARAM_SUBMODULES}\" \\\n -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n -depth=\"${PARAM_DEPTH}\" \\\n -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n # Determine if merging from a different repository or the same one\n if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n normalize_url() {\n echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n }\n\n NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n MERGE_REMOTE=\"origin\"\n else\n echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n echo \"Adding remote 'merge-source'...\"\n git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n MERGE_REMOTE=\"merge-source\"\n fi\n else\n echo \"Merging from the same repository (origin)\"\n MERGE_REMOTE=\"origin\"\n fi\n\n echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n else\n retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n fi\n\n echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n git config --global user.email \"tekton-git-clone@tekton.dev\"\n git config --global user.name \"Tekton Git Clone Task\"\n\n if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n echo \"--- Git Status ---\"\n git status\n echo \"------------------\"\n exit 1\n fi\n\n # Check if there are changes staged for commit\n if git diff --staged --quiet; then\n echo \"No diff was found, skipping merge...\" \u003e\u00262\n else\n echo \"Merge successful (no conflicts found), committing...\"\n if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n exit 1\n fi\n MERGED_SHA=$(git rev-parse HEAD)\n echo \"New HEAD after merge: ${MERGED_SHA}\"\n echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n fi\n\nelse\n echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n echo \"Fetching tags\"\n retry git fetch --tags\nfi\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "computeResources": {}, "env": [ { "name": "PARAM_ENABLE_SYMLINK_CHECK", "value": "true" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n while read -r symlink; do\n target=$(readlink -m \"$symlink\")\n if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n fi\n done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n return 1\n fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n echo \"Running symlink check\"\n check_symlinks\nfi\n", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-kapy/go-component-xehdbs:on-pr-585eac1e978b7d089e9c677cf9c0cb4381e52d4d.git", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "5d" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n", "name": "basic-auth", "optional": true }, { "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n", "name": "ssh-directory", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/sample-multi-component?rev=585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "build.appstudio.redhat.com/commit_sha": "585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "build.appstudio.redhat.com/pull_request_number": "34045", "build.appstudio.redhat.com/target_branch": "multi-component-base-lqwvpp", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "multi-component-base-lqwvpp", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "86200413253", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-sgbess", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-kapy/pipelinerun/go-component-xehdbs-on-pull-request-6sqhb", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-base-lqwvpp\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-xehdbs-pull-request.yaml\".pathChanged() )", "pipelinesascode.tekton.dev/original-prname": "go-component-xehdbs-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34045", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "redhat-appstudio-qe-bot", "pipelinesascode.tekton.dev/sha": "585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/sample-multi-component/commit/585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "pipelinesascode.tekton.dev/source-branch": "pr-branch-ioinde", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-kapy/results/e3d2a85f-786e-4fb5-9884-02c4f9cc8867/records/cf842deb-6fb4-4f15-824b-a1dd13b8200f", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"sample-multi-component\",\"commit\":\"585eac1e978b7d089e9c677cf9c0cb4381e52d4d\",\"eventType\":\"pull_request\",\"pull_request-id\":34045}", "results.tekton.dev/result": "build-e2e-kapy/results/e3d2a85f-786e-4fb5-9884-02c4f9cc8867", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "test.appstudio.openshift.io/pr-group": "pr-branch-ioinde" }, "creationTimestamp": "2026-07-09T18:44:21Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-09T18:44:59Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-positive-mc-xjfw", "appstudio.openshift.io/component": "go-component-xehdbs", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "86200413253", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "go-component-xehdbs-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34045", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/sha": "585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "go-component-xehdbs-on-pull-request-6sqhb", "tekton.dev/pipelineRun": "go-component-xehdbs-on-pull-request-6sqhb", "tekton.dev/pipelineRunUID": "e3d2a85f-786e-4fb5-9884-02c4f9cc8867", "tekton.dev/pipelineTask": "init", "tekton.dev/task": "init", "test.appstudio.openshift.io/pr-group-sha": "91a96d28753a80f1820d87e1904cfee097d5c47847b6408d097b1d63436925" }, "name": "go-component-xehdbs-on-pull-request-6sqhb-init", "namespace": "build-e2e-kapy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "go-component-xehdbs-on-pull-request-6sqhb", "uid": "e3d2a85f-786e-4fb5-9884-02c4f9cc8867" } ], "resourceVersion": "35913", "uid": "cf842deb-6fb4-4f15-824b-a1dd13b8200f" }, "spec": { "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "serviceAccountName": "build-pipeline-go-component-xehdbs", "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-09T18:44:25Z", "conditions": [ { "lastTransitionTime": "2026-07-09T18:44:25Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "go-component-xehdbs-on-pull-request-6sqhb-init-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, "entryPoint": "init", "uri": "quay.io/konflux-ci/tekton-catalog/task-init" } }, "results": [ { "name": "http-proxy", "type": "string", "value": "" }, { "name": "no-proxy", "type": "string", "value": "" } ], "startTime": "2026-07-09T18:44:21Z", "steps": [ { "container": "step-init", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init", "provenance": {}, "terminated": { "containerID": "containerd://1a41fdfc36821abea81a48801bcc353c50129c438c4c84a460b2abebfed2ba4e", "exitCode": 0, "finishedAt": "2026-07-09T18:44:24Z", "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-09T18:44:24Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.", "params": [ { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" } ], "results": [ { "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)", "name": "http-proxy", "type": "string" }, { "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)", "name": "no-proxy", "type": "string" } ], "steps": [ { "args": [ "--enable", "false" ], "command": [ "konflux-build-cli", "config", "cache-proxy" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "DEFAULT_HTTP_PROXY", "value": "squid.caching.svc.cluster.local:3128" }, { "name": "DEFAULT_NO_PROXY", "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai" }, { "name": "HTTP_PROXY_RESULTS_PATH", "value": "/tekton/results/http-proxy" }, { "name": "NO_PROXY_RESULTS_PATH", "value": "/tekton/results/no-proxy" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/sample-multi-component?rev=585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "build.appstudio.redhat.com/commit_sha": "585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "build.appstudio.redhat.com/pull_request_number": "34045", "build.appstudio.redhat.com/target_branch": "multi-component-base-lqwvpp", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "multi-component-base-lqwvpp", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "86200413253", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-sgbess", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-kapy/pipelinerun/go-component-xehdbs-on-pull-request-6sqhb", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-base-lqwvpp\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-xehdbs-pull-request.yaml\".pathChanged() )", "pipelinesascode.tekton.dev/original-prname": "go-component-xehdbs-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34045", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "redhat-appstudio-qe-bot", "pipelinesascode.tekton.dev/sha": "585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/sample-multi-component/commit/585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "pipelinesascode.tekton.dev/source-branch": "pr-branch-ioinde", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "results.tekton.dev/record": "build-e2e-kapy/results/e3d2a85f-786e-4fb5-9884-02c4f9cc8867/records/bbeeee37-03e6-4d36-bb0b-a508b0f62496", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"sample-multi-component\",\"commit\":\"585eac1e978b7d089e9c677cf9c0cb4381e52d4d\",\"eventType\":\"pull_request\",\"pull_request-id\":34045}", "results.tekton.dev/result": "build-e2e-kapy/results/e3d2a85f-786e-4fb5-9884-02c4f9cc8867", "results.tekton.dev/stored": "false", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "test.appstudio.openshift.io/pr-group": "pr-branch-ioinde" }, "creationTimestamp": "2026-07-09T18:44:33Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-09T18:44:59Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-positive-mc-xjfw", "appstudio.openshift.io/component": "go-component-xehdbs", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "86200413253", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "go-component-xehdbs-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34045", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/sha": "585eac1e978b7d089e9c677cf9c0cb4381e52d4d", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "go-component-xehdbs-on-pull-request-6sqhb", "tekton.dev/pipelineRun": "go-component-xehdbs-on-pull-request-6sqhb", "tekton.dev/pipelineRunUID": "e3d2a85f-786e-4fb5-9884-02c4f9cc8867", "tekton.dev/pipelineTask": "prefetch-dependencies", "tekton.dev/task": "prefetch-dependencies-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "91a96d28753a80f1820d87e1904cfee097d5c47847b6408d097b1d63436925" }, "name": "go-component-xehdbs-on-pull-request-6sqhb-prefetch-dependencies", "namespace": "build-e2e-kapy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "go-component-xehdbs-on-pull-request-6sqhb", "uid": "e3d2a85f-786e-4fb5-9884-02c4f9cc8867" } ], "resourceVersion": "35925", "uid": "bbeeee37-03e6-4d36-bb0b-a508b0f62496" }, "spec": { "params": [ { "name": "input", "value": "" }, { "name": "enable-package-registry-proxy", "value": "true" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-kapy/go-component-xehdbs@sha256:95ec12ecc658310949ab70cc861350daee18e828060092c59501e58081c7d1fa" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-kapy/go-component-xehdbs:on-pr-585eac1e978b7d089e9c677cf9c0cb4381e52d4d.prefetch" }, { "name": "ociArtifactExpiresAfter", "value": "5d" } ], "serviceAccountName": "build-pipeline-go-component-xehdbs", "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s", "workspaces": [ { "name": "git-basic-auth", "secret": { "secretName": "pac-gitauth-sgbess" } } ] }, "status": { "conditions": [ { "lastTransitionTime": "2026-07-09T18:44:37Z", "message": "Not all Steps in the Task have finished executing", "reason": "Running", "status": "Unknown", "type": "Succeeded" } ], "podName": "go-component-xehdbs-on-pull6718913a79ea2e5f619b568c53dfa484-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, "entryPoint": "prefetch-dependencies-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min" } }, "startTime": "2026-07-09T18:44:33Z", "steps": [ { "container": "step-skip-ta", "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "provenance": {}, "terminated": { "containerID": "containerd://77a04e6317780c4cd9f026a4694abcfcc078d3699d221db1703816351d42a11b", "exitCode": 0, "finishedAt": "2026-07-09T18:44:37Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-kapy/go-component-xehdbs@sha256:95ec12ecc658310949ab70cc861350daee18e828060092c59501e58081c7d1fa\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-09T18:44:37Z" }, "terminationReason": "Completed" }, { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://fdf4a04b9c3aea3219f033a89787ccfe8e0266792e55f9835e6e856e73ecbaf7", "exitCode": 0, "finishedAt": "2026-07-09T18:44:37Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-kapy/go-component-xehdbs@sha256:95ec12ecc658310949ab70cc861350daee18e828060092c59501e58081c7d1fa\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-09T18:44:37Z" }, "terminationReason": "Completed" }, { "container": "step-prefetch-dependencies", "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "provenance": {}, "running": { "startedAt": "2026-07-09T18:44:36Z" } }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact", "provenance": {}, "running": { "startedAt": "2026-07-09T18:44:37Z" } } ], "taskSpec": { "description": "Task that prefetches project dependencies for hermetic build.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": "service-ca.crt", "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "openshift-service-ca.crt", "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n", "name": "config-file-content", "type": "string" }, { "default": "true", "description": "Use the package registry proxy when prefetching dependencies", "name": "enable-package-registry-proxy", "type": "string" }, { "description": "Configures project packages that will have their dependencies prefetched.", "name": "input", "type": "string" }, { "default": "debug", "description": "Set the logging level (debug, info, warn, error, fatal).", "name": "log-level", "type": "string" }, { "default": "strict", "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).", "name": "mode", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.", "name": "sbom-type", "type": "string" } ], "results": [ { "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "computeResources": {}, "env": [ { "name": "INPUT" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-kapy/go-component-xehdbs@sha256:95ec12ecc658310949ab70cc861350daee18e828060092c59501e58081c7d1fa" } ], "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n mkdir -p /var/workdir/source\n mkdir -p /var/workdir/cachi2\n echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n" }, { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-kapy/go-component-xehdbs@sha256:95ec12ecc658310949ab70cc861350daee18e828060092c59501e58081c7d1fa=/var/workdir/source" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "debug" }, { "name": "KBC_PD_INPUT" }, { "name": "KBC_PD_SOURCE_DIR", "value": "/var/workdir/source" }, { "name": "KBC_PD_OUTPUT_DIR", "value": "/var/workdir/cachi2/output" }, { "name": "KBC_PD_SBOM_FORMAT", "value": "spdx" }, { "name": "KBC_PD_MODE", "value": "strict" }, { "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT", "value": "/cachi2/output" }, { "name": "KBC_PD_ENV_FILES", "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json" }, { "name": "KBC_PD_GIT_AUTH_DIRECTORY", "value": "/workspace/git-basic-auth" }, { "name": "WORKSPACE_NETRC_PATH" }, { "name": "CONFIG_FILE_CONTENT" }, { "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY", "value": "true" } ], "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n export KBC_PD_RHSM_ORG=/activation-key/org\n export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n", "volumeMounts": [ { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/mnt/config", "name": "config" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/service-ca", "name": "service-ca", "readOnly": true } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-kapy/go-component-xehdbs:on-pr-585eac1e978b7d089e9c677cf9c0cb4381e52d4d.prefetch", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source", "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "5d" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "emptyDir": {}, "name": "config" }, { "configMap": { "items": [ { "key": "service-ca.crt", "path": "ca-bundle.crt" } ], "name": "openshift-service-ca.crt", "optional": true }, "name": "service-ca" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n", "name": "git-basic-auth", "optional": true }, { "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n", "name": "netrc", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/sample-multi-component?rev=6dc038174f6fc750f1161ce779e09417d14f9942", "build.appstudio.redhat.com/commit_sha": "6dc038174f6fc750f1161ce779e09417d14f9942", "build.appstudio.redhat.com/pull_request_number": "34044", "build.appstudio.redhat.com/target_branch": "multi-component-base-lqwvpp", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "multi-component-base-lqwvpp", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "86199200815", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-sewclj", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-kapy/pipelinerun/python-component-vrlzjc-on-pull-request-78lrn", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-base-lqwvpp\" \u0026\u0026 ( \"python-component/***\".pathChanged() || \".tekton/python-component-vrlzjc-pull-request.yaml\".pathChanged() )", "pipelinesascode.tekton.dev/original-prname": "python-component-vrlzjc-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34044", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-e2e-tests[bot]", "pipelinesascode.tekton.dev/sha": "6dc038174f6fc750f1161ce779e09417d14f9942", "pipelinesascode.tekton.dev/sha-title": "konflux-ci e2e-tests update python-component-vrlzjc", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/sample-multi-component/commit/6dc038174f6fc750f1161ce779e09417d14f9942", "pipelinesascode.tekton.dev/source-branch": "konflux-python-component-vrlzjc", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-kapy/results/d4d6eb19-eb38-439b-a429-4d857ee0722d/records/ea45f51c-22b3-4513-b4d1-9d135e682f6b", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"sample-multi-component\",\"commit\":\"6dc038174f6fc750f1161ce779e09417d14f9942\",\"eventType\":\"pull_request\",\"pull_request-id\":34044}", "results.tekton.dev/result": "build-e2e-kapy/results/d4d6eb19-eb38-439b-a429-4d857ee0722d", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "virus, konflux", "test.appstudio.openshift.io/pr-group": "konflux-python-component-vrlzjc" }, "creationTimestamp": "2026-07-09T18:42:08Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-09T18:44:10Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-positive-mc-xjfw", "appstudio.openshift.io/component": "python-component-vrlzjc", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "86199200815", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "python-component-vrlzjc-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34044", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/sha": "6dc038174f6fc750f1161ce779e09417d14f9942", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "python-component-vrlzjc-on-pull-request-78lrn", "tekton.dev/pipelineRun": "python-component-vrlzjc-on-pull-request-78lrn", "tekton.dev/pipelineRunUID": "d4d6eb19-eb38-439b-a429-4d857ee0722d", "tekton.dev/pipelineTask": "clamav-scan", "tekton.dev/task": "clamav-scan-min", "test.appstudio.openshift.io/pr-group-sha": "e8af099cf12c3050aa44753488178d63a45115e040abcc0d52b257804c7d17" }, "name": "python-component-vrlzjc-on-pull-request-78lrn-clamav-scan", "namespace": "build-e2e-kapy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "python-component-vrlzjc-on-pull-request-78lrn", "uid": "d4d6eb19-eb38-439b-a429-4d857ee0722d" } ], "resourceVersion": "35077", "uid": "ea45f51c-22b3-4513-b4d1-9d135e682f6b" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:30d17c3f7c4cd956f6c48f1de22db12e815b20f2582e32bfb7c9cf410c6ba67f" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-kapy/python-component-vrlzjc:on-pr-6dc038174f6fc750f1161ce779e09417d14f9942" } ], "serviceAccountName": "build-pipeline-python-component-vrlzjc", "taskRef": { "params": [ { "name": "name", "value": "clamav-scan-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min:0.3@sha256:908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-09T18:43:44Z", "conditions": [ { "lastTransitionTime": "2026-07-09T18:43:44Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "python-component-vrlzjc-on-pull-request-78lrn-clamav-scan-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "908e356d7a3bc3e472a9075a1ce1370486361007b3a86e3f61c2a6af7136a335" }, "entryPoint": "clamav-scan-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan-min" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-kapy/python-component-vrlzjc:on-pr-6dc038174f6fc750f1161ce779e09417d14f9942\", \"digests\": [\"sha256:30d17c3f7c4cd956f6c48f1de22db12e815b20f2582e32bfb7c9cf410c6ba67f\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1783622620\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n" } ], "startTime": "2026-07-09T18:42:08Z", "steps": [ { "container": "step-extract-and-scan-image", "imageID": "quay.io/konflux-ci/clamav-db@sha256:f852c36fbe312f177d30582a06b4e8332fa7cc87b2849773b97620e7be275612", "name": "extract-and-scan-image", "provenance": {}, "terminated": { "containerID": "containerd://7e7e56e465b54316bc526f5d88c59788e25cad263ca29bb313be9ac79429d195", "exitCode": 0, "finishedAt": "2026-07-09T18:43:41Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-kapy/python-component-vrlzjc:on-pr-6dc038174f6fc750f1161ce779e09417d14f9942\\\", \\\"digests\\\": [\\\"sha256:30d17c3f7c4cd956f6c48f1de22db12e815b20f2582e32bfb7c9cf410c6ba67f\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783622620\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-09T18:42:16Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "provenance": {}, "terminated": { "containerID": "containerd://a131a7d049f7fc528c9a861743dc118664947c37d5ff2418758bb0b7bca06426", "exitCode": 0, "finishedAt": "2026-07-09T18:43:44Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-kapy/python-component-vrlzjc:on-pr-6dc038174f6fc750f1161ce779e09417d14f9942\\\", \\\"digests\\\": [\\\"sha256:30d17c3f7c4cd956f6c48f1de22db12e815b20f2582e32bfb7c9cf410c6ba67f\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783622620\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-09T18:43:41Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "Image arch.", "name": "image-arch", "type": "string" }, { "default": "", "description": "unused", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "8", "description": "Maximum number of threads clamd runs.", "name": "clamd-max-threads", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-upload", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "512m", "memory": "3Gi" }, "requests": { "cpu": "512m", "memory": "3Gi" } }, "env": [ { "name": "HOME", "value": "/work" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-kapy/python-component-vrlzjc:on-pr-6dc038174f6fc750f1161ce779e09417d14f9942" }, { "name": "IMAGE_DIGEST", "value": "sha256:30d17c3f7c4cd956f6c48f1de22db12e815b20f2582e32bfb7c9cf410c6ba67f" }, { "name": "IMAGE_ARCH" }, { "name": "MAX_THREADS", "value": "8" } ], "image": "quay.io/konflux-ci/clamav-db:latest", "name": "extract-and-scan-image", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n mkdir -p ~/.docker\n echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n# $1: destination - path to the content to scan\n# $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n# $3: digest - digest to add to digests_processed array\n# $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n local destination=\"$1\"\n local suffix=\"$2\"\n local digest=\"$3\"\n local scan_message=\"${4:-Scanning content}\"\n\n db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n echo \"$scan_message. This operation may take a while.\"\n clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n digests_processed+=(\"\\\"$digest\\\"\")\n\n if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n # OPA/EC requires structured data input, add clamAV log into json\n jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o json \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o appstudio \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n\n if [ -n \"$raw_manifest\" ]; then\n media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n # Determine if this is an OCI artifact (not a container image)\n # OCI artifacts typically have:\n # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n # - An explicit artifactType field that is not a container image type\n is_oci_artifact=false\n\n # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n is_oci_artifact=true\n fi\n\n # Check if artifactType is set and is not a container image type\n if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n is_oci_artifact=true\n fi\n\n if [ \"$is_oci_artifact\" = true ]; then\n # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n # This looks like a container image manifest, but get_image_manifests failed\n echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n note=\"Task clamav-scan-min failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n else\n # Likely an OCI artifact with non-standard media type\n echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan-min failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n fi\n else\n echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n note=\"Task clamav-scan-min failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n echo \"Detected container image. Processing image manifests.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n # Proceed only if a specific arch is provided.\n # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n if [ -n \"$IMAGE_ARCH\" ]; then\n arch=\"${IMAGE_ARCH#*/}\"\n if [ \"${arch}\" = \"x86_64\" ]; then\n arch=\"amd64\"\n fi\n\n # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n arch=\"amd64\"\n ;;\n esac\n\n image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n fi\n\n while read -r arch arch_sha; do\n destination=\"content-${arch}\"\n mkdir -p \"$destination\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n if ! retry oc image extract --confirm --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"; then\n echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n exit 0\n fi\n\n # Scan and process container image for this architecture\n scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n {\n \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n \"namespace\" : $item.namespace,\n \"successes\" : (.successes + $item.successes),\n \"failures\" : (.failures + $item.failures),\n \"warnings\" : (.warnings + $item.warnings),\n \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n })' /work/logs/clamscan-ec-test-*.json | tee \"/tekton/results/TEST_OUTPUT\"\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_UPLOAD", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-kapy/python-component-vrlzjc:on-pr-6dc038174f6fc750f1161ce779e09417d14f9942" }, { "name": "IMAGE_DIGEST", "value": "sha256:30d17c3f7c4cd956f6c48f1de22db12e815b20f2582e32bfb7c9cf410c6ba67f" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n echo \"Upload skipped by parameter.\"\n exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n MEDIA_TYPE=text/vnd.clamav\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n MEDIA_TYPE=application/vnd.konflux.test_output+json\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ ${#args[@]} -eq 0 ]; then\n echo \"No files found. Skipping upload.\"\n exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n", "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" } ], "volumes": [ { "emptyDir": {}, "name": "dbfolder" }, { "emptyDir": {}, "name": "work" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/sample-multi-component?rev=6dc038174f6fc750f1161ce779e09417d14f9942", "build.appstudio.redhat.com/commit_sha": "6dc038174f6fc750f1161ce779e09417d14f9942", "build.appstudio.redhat.com/pull_request_number": "34044", "build.appstudio.redhat.com/target_branch": "multi-component-base-lqwvpp", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "multi-component-base-lqwvpp", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "86199200815", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-sewclj", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-kapy/pipelinerun/python-component-vrlzjc-on-pull-request-78lrn", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-base-lqwvpp\" \u0026\u0026 ( \"python-component/***\".pathChanged() || \".tekton/python-component-vrlzjc-pull-request.yaml\".pathChanged() )", "pipelinesascode.tekton.dev/original-prname": "python-component-vrlzjc-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34044", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-e2e-tests[bot]", "pipelinesascode.tekton.dev/sha": "6dc038174f6fc750f1161ce779e09417d14f9942", "pipelinesascode.tekton.dev/sha-title": "konflux-ci e2e-tests update python-component-vrlzjc", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/sample-multi-component/commit/6dc038174f6fc750f1161ce779e09417d14f9942", "pipelinesascode.tekton.dev/source-branch": "konflux-python-component-vrlzjc", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-kapy/results/d4d6eb19-eb38-439b-a429-4d857ee0722d/records/17772150-ce22-41f7-b913-435413193923", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"sample-multi-component\",\"commit\":\"6dc038174f6fc750f1161ce779e09417d14f9942\",\"eventType\":\"pull_request\",\"pull_request-id\":34044}", "results.tekton.dev/result": "build-e2e-kapy/results/d4d6eb19-eb38-439b-a429-4d857ee0722d", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "test.appstudio.openshift.io/pr-group": "konflux-python-component-vrlzjc" }, "creationTimestamp": "2026-07-09T18:42:08Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-09T18:44:10Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-positive-mc-xjfw", "appstudio.openshift.io/component": "python-component-vrlzjc", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "86199200815", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "python-component-vrlzjc-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34044", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/sha": "6dc038174f6fc750f1161ce779e09417d14f9942", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "python-component-vrlzjc-on-pull-request-78lrn", "tekton.dev/pipelineRun": "python-component-vrlzjc-on-pull-request-78lrn", "tekton.dev/pipelineRunUID": "d4d6eb19-eb38-439b-a429-4d857ee0722d", "tekton.dev/pipelineTask": "tpa-scan", "tekton.dev/task": "tpa-scan", "test.appstudio.openshift.io/pr-group-sha": "e8af099cf12c3050aa44753488178d63a45115e040abcc0d52b257804c7d17" }, "name": "python-component-vrlzjc-on-pull-request-78lrn-tpa-scan", "namespace": "build-e2e-kapy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "python-component-vrlzjc-on-pull-request-78lrn", "uid": "d4d6eb19-eb38-439b-a429-4d857ee0722d" } ], "resourceVersion": "35036", "uid": "17772150-ce22-41f7-b913-435413193923" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:30d17c3f7c4cd956f6c48f1de22db12e815b20f2582e32bfb7c9cf410c6ba67f" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-kapy/python-component-vrlzjc:on-pr-6dc038174f6fc750f1161ce779e09417d14f9942" } ], "serviceAccountName": "build-pipeline-python-component-vrlzjc", "taskRef": { "params": [ { "name": "name", "value": "tpa-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan:0.1@sha256:8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-09T18:42:46Z", "conditions": [ { "lastTransitionTime": "2026-07-09T18:42:46Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "python-component-vrlzjc-on-pull-request-78lrn-tpa-scan-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "8375c9e4ee2ee417881120187be1281c50b85a8b23d8d24785e1dc96a3018c8e" }, "entryPoint": "tpa-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-tpa-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-kapy/python-component-vrlzjc:on-pr-6dc038174f6fc750f1161ce779e09417d14f9942\", \"digests\": [\"sha256:30d17c3f7c4cd956f6c48f1de22db12e815b20f2582e32bfb7c9cf410c6ba67f\"]}}\n" }, { "name": "REPORTS", "type": "string", "value": "{\"sha256:30d17c3f7c4cd956f6c48f1de22db12e815b20f2582e32bfb7c9cf410c6ba67f\":\"sha256:64e39ea5c60f07501cc916fedede078f83434711872a2682f1a5718cd9e4ca23\"}\n" }, { "name": "SCAN_OUTPUT", "type": "string", "value": "{\"vulnerabilities\":{\"critical\":5,\"high\":49,\"medium\":92,\"low\":15,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-07-09T18:42:45+00:00\",\"note\":\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "startTime": "2026-07-09T18:42:09Z", "steps": [ { "container": "step-get-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "get-vulnerabilities", "provenance": {}, "terminated": { "containerID": "containerd://566c8fe51a6fa5e670d5a9be2246b61665430087dbb5b9a97a7e68eda568dac5", "exitCode": 0, "finishedAt": "2026-07-09T18:42:39Z", "reason": "Completed", "startedAt": "2026-07-09T18:42:17Z" }, "terminationReason": "Completed" }, { "container": "step-oci-attach-report", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "provenance": {}, "terminated": { "containerID": "containerd://3d943811b4a832f0f97b32c0491f060a4c8dbd0e02c72d26fc29e1bae2be7dc9", "exitCode": 0, "finishedAt": "2026-07-09T18:42:43Z", "reason": "Completed", "startedAt": "2026-07-09T18:42:39Z" }, "terminationReason": "Completed" }, { "container": "step-conftest-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "conftest-vulnerabilities", "provenance": {}, "terminated": { "containerID": "containerd://d10351fc529c6af024ff3f126899891e89d7ab46b3a697e1d780b1511d1c8c8b", "exitCode": 0, "finishedAt": "2026-07-09T18:42:45Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-kapy/python-component-vrlzjc:on-pr-6dc038174f6fc750f1161ce779e09417d14f9942\\\", \\\"digests\\\": [\\\"sha256:30d17c3f7c4cd956f6c48f1de22db12e815b20f2582e32bfb7c9cf410c6ba67f\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:30d17c3f7c4cd956f6c48f1de22db12e815b20f2582e32bfb7c9cf410c6ba67f\\\":\\\"sha256:64e39ea5c60f07501cc916fedede078f83434711872a2682f1a5718cd9e4ca23\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":5,\\\"high\\\":49,\\\"medium\\\":92,\\\"low\\\":15,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-07-09T18:42:45+00:00\\\",\\\"note\\\":\\\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-09T18:42:43Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans container images for vulnerabilities using the TPA vulnerability scanner, by comparing the components of container image against the vulnerability databases.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "The platform which will be scanned by this task.", "name": "image-platform", "type": "string" }, { "default": "https://exhort.stage.devshift.net/api/v5/analysis", "description": "The url of the TPA instance which will be used for scanning.", "name": "tpa-url", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-oci-attach-report", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "TPA scan result.", "name": "SCAN_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" }, { "description": "Mapping of image digests to report digests", "name": "REPORTS", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "800m", "memory": "2Gi" }, "requests": { "cpu": "800m", "memory": "2Gi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-kapy/python-component-vrlzjc:on-pr-6dc038174f6fc750f1161ce779e09417d14f9942" }, { "name": "IMAGE_DIGEST", "value": "sha256:30d17c3f7c4cd956f6c48f1de22db12e815b20f2582e32bfb7c9cf410c6ba67f" }, { "name": "IMAGE_PLATFORM" }, { "name": "TPA_URL", "value": "https://exhort.stage.devshift.net/api/v5/analysis" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "imagePullPolicy": "Always", "name": "get-vulnerabilities", "script": "#!/usr/bin/env bash\n\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\necho \"Inspecting raw image manifest $imageanddigest.\"\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\necho \"Selecting auth\"\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${imageanddigest}\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n done\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task tpa-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n\ntpa_scan() {\n local sbom_file=${1}\n local arch=${2}\n local sbom_format\n\n sbom_format=$(jq -r 'if .bomFormat == \"CycloneDX\" then \"cyclonedx\" else \"spdx\" end' \u003c \"${sbom_file}\")\n retry curl -f --show-error -L -X POST -T \"${sbom_file}\" -H \"Content-Type:application/vnd.${sbom_format}+json\" \"${TPA_URL}\" | tee \"tpa-report-${arch}.json\";\n}\n\nrun_tpa_on_arch() {\n local arch=\"$1\"\n local sha_file=\"image-manifest-${arch}.sha\"\n local sbom_file_path=\"/tmp/sbom-${arch}.json\"\n local arch_sha=\"\"\n\n if [ -e \"${sha_file}\" ]; then\n arch_sha=$(\u003c\"${sha_file}\")\n arch_imageanddigest=$(echo -n \"${imagewithouttag}@${arch_sha}\")\n else\n echo \"Couldn't find the SHA file for the requested architecture.\"\n exit 1\n fi\n\n echo \"Selecting auth\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Attempt to download the SBOM file via cosign\n\n if ! retry cosign download sbom \"${arch_imageanddigest}\" \u003e \"${sbom_file_path}\"; then\n echo \"Unable to download SBOM for the architecture ${arch}.\"\n exit 1\n fi\n\n if [ -e \"${sbom_file_path}\" ]; then\n local arch_sha\n arch_sha=$(\u003c\"$sha_file\")\n\n echo \"Running TPA scan on $arch image manifest...\"\n tpa_scan \"${sbom_file_path}\" \"$arch\" || true\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n else\n echo \"Couldn't find the SBOM file for the requested ${arch} architecture.\"\n exit 1\n fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run the tpa scan on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n arch=\"${platform#*/}\"\n if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n arch=\"amd64\"\n fi\n # Validate against supported arch list. If it's not a known arch, fallback to amd64\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n exit 1\n ;;\n esac\n\n run_tpa_on_arch \"$arch\"\n\n# If no platform is specified, run TPA scan on all available image manifests\nelse\n for sha_file in image-manifest-*.sha; do\n if [ -e \"$sha_file\" ]; then\n arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n run_tpa_on_arch \"$arch\"\n fi\n done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_OCI_ATTACH_REPORT", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-kapy/python-component-vrlzjc:on-pr-6dc038174f6fc750f1161ce779e09417d14f9942" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "oci-attach-report", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n echo 'OCI attach report skipped by parameter.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nif ! compgen -G \"tpa-report-*.json\" \u003e /dev/null; then\n echo 'No TPA reports generated. Skipping upload.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n report_file=\"$1\"\n arch=\"${report_file/*-}\"\n echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.tpa-report+json'\n\nreports_json=\"{}\"\nfor f in tpa-report-*.json; do\n digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n image_ref=\"${repository}@${digest}\"\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${image_ref}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n echo \"Attaching $f to ${image_ref}\"\n if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n \"/tmp/auth/config.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n then\n echo \"Failed to attach ${f} to ${image_ref}\"\n exit 1\n fi\n # shellcheck disable=SC2016\n reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/redhat-user-workloads/rhtap-integration-tenant/konflux-test:v1.4.52@sha256:deabe80a01dca3a8a0edb709324e30cbf0baa176f7a181bbb695323f506f7aac", "name": "conftest-vulnerabilities", "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\ntpa_result_files=$(ls /tekton/home/tpa-report-*.json 2\u003e/dev/null || true)\nif [ -z \"$tpa_result_files\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: No tpa-report files found in /tekton/home.\"\n exit 1\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $tpa_result_files; do\n file_suffix=$(basename \"$file\" | sed 's/tpa-report-//;s/.json//')\n if [ ! -s \"$file\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n else\n /usr/bin/conftest test --no-fail $file \\\n --policy /project/rhtpa/vulnerabilities-check.rego --namespace required_checks \\\n --output=json | tee /tekton/home/tpa-vulnerabilities-\"${file_suffix}\".json || true\n fi\n\n #check for missing \"tpa-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n if [ ! -f \"/tekton/home/tpa-vulnerabilities-$file_suffix.json\" ]; then\n missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/tpa-vulnerabilities-$file_suffix.json\"\n fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n note=\"Task tpa-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/tpa-vulnerabilities-*.json; do\n result=$(jq -rce \\\n '{\n vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n },\n unpatched_vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"rhtpa_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n }\n }' \"$file\")\n\n scan_result=$(jq -s -rce \\\n '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task tpa-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by TPA.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } } } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/sample-multi-component?rev=6a4f7a85674d8a84f71e055175aae51ec55ba52f", "build.appstudio.redhat.com/commit_sha": "6a4f7a85674d8a84f71e055175aae51ec55ba52f", "build.appstudio.redhat.com/target_branch": "multi-component-base-lqwvpp", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "multi-component-base-lqwvpp", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "86200342096", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-felffo", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-kapy/pipelinerun/python-component-vrlzjc-on-push-jtsgc", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"multi-component-base-lqwvpp\" \u0026\u0026 ( \"python-component/***\".pathChanged() || \".tekton/python-component-vrlzjc-push.yaml\".pathChanged() )", "pipelinesascode.tekton.dev/original-prname": "python-component-vrlzjc-on-push", "pipelinesascode.tekton.dev/pull-request": "34044", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "redhat-appstudio-qe-bot", "pipelinesascode.tekton.dev/sha": "6a4f7a85674d8a84f71e055175aae51ec55ba52f", "pipelinesascode.tekton.dev/sha-title": "Merge pull request #34044 from redhat-appstudio-qe/konflux-python-component-vrlzjc\n\nkonflux-ci e2e-tests update python-component-vrlzjc", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/sample-multi-component/commit/6a4f7a85674d8a84f71e055175aae51ec55ba52f", "pipelinesascode.tekton.dev/source-branch": "refs/heads/multi-component-base-lqwvpp", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-kapy/results/a1b83e9b-30d2-4849-a993-3a6b331f0b9f/records/7e69f3c0-e704-4804-8b83-f8a1896ae907", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"sample-multi-component\",\"commit\":\"6a4f7a85674d8a84f71e055175aae51ec55ba52f\",\"eventType\":\"push\",\"pull_request-id\":34044}", "results.tekton.dev/result": "build-e2e-kapy/results/a1b83e9b-30d2-4849-a993-3a6b331f0b9f", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "test.appstudio.openshift.io/pr-status": "merged" }, "creationTimestamp": "2026-07-09T18:44:04Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-09T18:44:11Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-positive-mc-xjfw", "appstudio.openshift.io/component": "python-component-vrlzjc", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "86200342096", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "python-component-vrlzjc-on-push", "pipelinesascode.tekton.dev/pull-request": "34044", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/sha": "6a4f7a85674d8a84f71e055175aae51ec55ba52f", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "python-component-vrlzjc-on-push-jtsgc", "tekton.dev/pipelineRun": "python-component-vrlzjc-on-push-jtsgc", "tekton.dev/pipelineRunUID": "a1b83e9b-30d2-4849-a993-3a6b331f0b9f", "tekton.dev/pipelineTask": "init", "tekton.dev/task": "init" }, "name": "python-component-vrlzjc-on-push-jtsgc-init", "namespace": "build-e2e-kapy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "python-component-vrlzjc-on-push-jtsgc", "uid": "a1b83e9b-30d2-4849-a993-3a6b331f0b9f" } ], "resourceVersion": "35093", "uid": "7e69f3c0-e704-4804-8b83-f8a1896ae907" }, "spec": { "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "serviceAccountName": "build-pipeline-python-component-vrlzjc", "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-09T18:44:08Z", "conditions": [ { "lastTransitionTime": "2026-07-09T18:44:08Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "python-component-vrlzjc-on-push-jtsgc-init-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, "entryPoint": "init", "uri": "quay.io/konflux-ci/tekton-catalog/task-init" } }, "results": [ { "name": "http-proxy", "type": "string", "value": "" }, { "name": "no-proxy", "type": "string", "value": "" } ], "startTime": "2026-07-09T18:44:05Z", "steps": [ { "container": "step-init", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init", "provenance": {}, "terminated": { "containerID": "containerd://74186539c9ff9e264a75762333b6410b14a2513ded67dd5386c90e347325773d", "exitCode": 0, "finishedAt": "2026-07-09T18:44:08Z", "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-09T18:44:08Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.", "params": [ { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" } ], "results": [ { "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)", "name": "http-proxy", "type": "string" }, { "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)", "name": "no-proxy", "type": "string" } ], "steps": [ { "args": [ "--enable", "false" ], "command": [ "konflux-build-cli", "config", "cache-proxy" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "DEFAULT_HTTP_PROXY", "value": "squid.caching.svc.cluster.local:3128" }, { "name": "DEFAULT_NO_PROXY", "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai" }, { "name": "HTTP_PROXY_RESULTS_PATH", "value": "/tekton/results/http-proxy" }, { "name": "NO_PROXY_RESULTS_PATH", "value": "/tekton/results/no-proxy" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.redhat.com/nudged-components": "gh-multi-component-child-mogc", "build.appstudio.redhat.com/nudging-commit": "build-nudge-parent-vbyurr?rev=3fff8c1c8e4baaba9821867d159ac7483eaa7a5f", "build.appstudio.redhat.com/nudging-component": "gh-multi-component-parent-mogc", "build.appstudio.redhat.com/nudging-image": "quay.io/redhat-appstudio-qe/build-e2e-kjkg/gh-multi-component-parent-mogc:3fff8c1c8e4baaba9821867d159ac7483eaa7a5f", "build.appstudio.redhat.com/nudging-pipeline": "gh-multi-component-parent-mogc-on-push-mn4bk", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-kjkg/results/de39c742-ddd6-4f6f-9a20-a2c685b75bc1/records/2d84d8af-4605-4ffd-9ed9-a1d123c48e7f", "results.tekton.dev/result": "build-e2e-kjkg/results/de39c742-ddd6-4f6f-9a20-a2c685b75bc1", "results.tekton.dev/stored": "true" }, "creationTimestamp": "2026-07-09T18:28:45Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "build.appstudio.redhat.com/type": "nudge", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-pipeline-1783621725-3dbfd", "tekton.dev/pipelineRun": "renovate-pipeline-1783621725-3dbfd", "tekton.dev/pipelineRunUID": "de39c742-ddd6-4f6f-9a20-a2c685b75bc1", "tekton.dev/pipelineTask": "renovate" }, "name": "renovate-pipeline-1783621725-3dbfd-renovate", "namespace": "build-e2e-kjkg", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-pipeline-1783621725-3dbfd", "uid": "de39c742-ddd6-4f6f-9a20-a2c685b75bc1" } ], "resourceVersion": "27448", "uid": "2d84d8af-4605-4ffd-9ed9-a1d123c48e7f" }, "spec": { "serviceAccountName": "build-pipeline-gh-multi-component-parent-mogc", "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_558e72c2c3 RENOVATE_CONFIG_FILE=/configs/gh-multi-component-child-mogc-553dd.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_kjkg_gh_multi_component_parent_mogc_b516e1d88b','password':'${TOKEN_27cec2ab1b}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1783621725-3dbfd" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1783621725-3dbfd" } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1783621725-3dbfd" }, "name": "renovate-pipeline-1783621725-3dbfd" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-09T18:33:14Z", "conditions": [ { "lastTransitionTime": "2026-07-09T18:33:14Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "renovate-pipeline-1783621725-3dbfd-renovate-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-07-09T18:28:45Z", "steps": [ { "container": "step-renovate", "imageID": "quay.io/konflux-ci/mintmaker-renovate-image@sha256:67d26b20533790565a2949a3f732d595dda9378fea506f1cba88ca17cef13873", "name": "renovate", "provenance": {}, "terminated": { "containerID": "containerd://ae9d0bd51aac4b0a58cb02a5cf6d58de149570085751d676a6e07ff879826a4a", "exitCode": 0, "finishedAt": "2026-07-09T18:33:13Z", "reason": "Completed", "startedAt": "2026-07-09T18:33:00Z" }, "terminationReason": "Completed" } ], "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_558e72c2c3 RENOVATE_CONFIG_FILE=/configs/gh-multi-component-child-mogc-553dd.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_kjkg_gh_multi_component_parent_mogc_b516e1d88b','password':'${TOKEN_27cec2ab1b}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1783621725-3dbfd" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1783621725-3dbfd" } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1783621725-3dbfd" }, "name": "renovate-pipeline-1783621725-3dbfd" } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }