{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw?rev=a74227aa19d83f40f776ada6d909041cca68a655", "build.appstudio.redhat.com/commit_sha": "a74227aa19d83f40f776ada6d909041cca68a655", "build.appstudio.redhat.com/target_branch": "base-qtcjej", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-qtcjej", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "85935561094", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "incoming", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-pasvim", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-puyp/pipelinerun/gh-test-custom-branch-nmitlf-on-push-mgtxr", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-qtcjej\"", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-nmitlf-on-push", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-devfile-sample-hello-world-suofaw", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "incoming", "pipelinesascode.tekton.dev/sha": "a74227aa19d83f40f776ada6d909041cca68a655", "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-test-custom-branch-nmitlf", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw/commit/a74227aa19d83f40f776ada6d909041cca68a655", "pipelinesascode.tekton.dev/source-branch": "base-qtcjej", "pipelinesascode.tekton.dev/source-repo-url": "", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-suofaw", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-puyp/results/7e6c6eb0-912b-43da-b8d9-0f31bb19bad5/records/633fb63c-4b53-44f8-99fc-d22dd8f9a2fb", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-suofaw\",\"commit\":\"a74227aa19d83f40f776ada6d909041cca68a655\",\"eventType\":\"incoming\"}", "results.tekton.dev/result": "build-e2e-puyp/results/7e6c6eb0-912b-43da-b8d9-0f31bb19bad5", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux" }, "creationTimestamp": "2026-07-08T17:20:11Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-njag", "appstudio.openshift.io/component": "gh-test-custom-branch-nmitlf", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "85935561094", "pipelinesascode.tekton.dev/event-type": "incoming", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-nmitlf-on-push", "pipelinesascode.tekton.dev/repository": "thub-com-redhat-appstudio-qe-devfile-sample-hello-world-suofaw", "pipelinesascode.tekton.dev/sha": "a74227aa19d83f40f776ada6d909041cca68a655", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-suofaw", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gh-test-custom-branch-nmitlf-on-push-mgtxr", "tekton.dev/pipelineRun": "gh-test-custom-branch-nmitlf-on-push-mgtxr", "tekton.dev/pipelineRunUID": "7e6c6eb0-912b-43da-b8d9-0f31bb19bad5", "tekton.dev/pipelineTask": "prefetch-dependencies", "tekton.dev/task": "prefetch-dependencies-oci-ta-min" }, "name": "gh-test-c22555887f40fd131af24be631dba440c-prefetch-dependencies", "namespace": "build-e2e-puyp", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gh-test-custom-branch-nmitlf-on-push-mgtxr", "uid": "7e6c6eb0-912b-43da-b8d9-0f31bb19bad5" } ], "resourceVersion": "30078", "uid": "633fb63c-4b53-44f8-99fc-d22dd8f9a2fb" }, "spec": { "params": [ { "name": "input", "value": "" }, { "name": "enable-package-registry-proxy", "value": "true" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf@sha256:4b785b4fc6a99fff47fd3cdbe0c5ca820e5b1dceac738446493165ae596d8216" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf:a74227aa19d83f40f776ada6d909041cca68a655.prefetch" }, { "name": "ociArtifactExpiresAfter", "value": "" } ], "serviceAccountName": "build-pipeline-gh-test-custom-branch-nmitlf", "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s", "workspaces": [ { "name": "git-basic-auth", "secret": { "secretName": "pac-gitauth-pasvim" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-07-08T17:20:57Z", "conditions": [ { "lastTransitionTime": "2026-07-08T17:20:57Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gh-test-c22555887f40fd131afa2eacc5f961d87e7d4732c5aee4c6258-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, "entryPoint": "prefetch-dependencies-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min" } }, "results": [ { "name": "CACHI2_ARTIFACT", "type": "string", "value": "" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf@sha256:4b785b4fc6a99fff47fd3cdbe0c5ca820e5b1dceac738446493165ae596d8216" } ], "startTime": "2026-07-08T17:20:11Z", "steps": [ { "container": "step-skip-ta", "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "provenance": {}, "terminated": { "containerID": "containerd://b37d029589c391befe823c4871adc0946a4e80938b698d945d3ad3a3f0e49065", "exitCode": 0, "finishedAt": "2026-07-08T17:20:16Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf@sha256:4b785b4fc6a99fff47fd3cdbe0c5ca820e5b1dceac738446493165ae596d8216\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:20:16Z" }, "terminationReason": "Completed" }, { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://c44265280372f9f29ef78ed1e0706f0ce0d4ca640c56da0edb1928c41d0bcff3", "exitCode": 0, "finishedAt": "2026-07-08T17:20:16Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf@sha256:4b785b4fc6a99fff47fd3cdbe0c5ca820e5b1dceac738446493165ae596d8216\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:20:16Z" }, "terminationReason": "Completed" }, { "container": "step-prefetch-dependencies", "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "provenance": {}, "terminated": { "containerID": "containerd://170ea2a9e9ba91d4261b22f2113dbf5a168a4a07be830e8f85b39238197888ce", "exitCode": 0, "finishedAt": "2026-07-08T17:20:55Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf@sha256:4b785b4fc6a99fff47fd3cdbe0c5ca820e5b1dceac738446493165ae596d8216\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:20:17Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://36b46cadfcfa45533675f834bc1c977dfdda89acdf9e685573b0e1047b2a7628", "exitCode": 0, "finishedAt": "2026-07-08T17:20:56Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf@sha256:4b785b4fc6a99fff47fd3cdbe0c5ca820e5b1dceac738446493165ae596d8216\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:20:56Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Task that prefetches project dependencies for hermetic build.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": "service-ca.crt", "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "openshift-service-ca.crt", "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n", "name": "config-file-content", "type": "string" }, { "default": "true", "description": "Use the package registry proxy when prefetching dependencies", "name": "enable-package-registry-proxy", "type": "string" }, { "description": "Configures project packages that will have their dependencies prefetched.", "name": "input", "type": "string" }, { "default": "debug", "description": "Set the logging level (debug, info, warn, error, fatal).", "name": "log-level", "type": "string" }, { "default": "strict", "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).", "name": "mode", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.", "name": "sbom-type", "type": "string" } ], "results": [ { "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "computeResources": {}, "env": [ { "name": "INPUT" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf@sha256:4b785b4fc6a99fff47fd3cdbe0c5ca820e5b1dceac738446493165ae596d8216" } ], "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n mkdir -p /var/workdir/source\n mkdir -p /var/workdir/cachi2\n echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n" }, { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf@sha256:4b785b4fc6a99fff47fd3cdbe0c5ca820e5b1dceac738446493165ae596d8216=/var/workdir/source" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "debug" }, { "name": "KBC_PD_INPUT" }, { "name": "KBC_PD_SOURCE_DIR", "value": "/var/workdir/source" }, { "name": "KBC_PD_OUTPUT_DIR", "value": "/var/workdir/cachi2/output" }, { "name": "KBC_PD_SBOM_FORMAT", "value": "spdx" }, { "name": "KBC_PD_MODE", "value": "strict" }, { "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT", "value": "/cachi2/output" }, { "name": "KBC_PD_ENV_FILES", "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json" }, { "name": "KBC_PD_GIT_AUTH_DIRECTORY", "value": "/workspace/git-basic-auth" }, { "name": "WORKSPACE_NETRC_PATH" }, { "name": "CONFIG_FILE_CONTENT" }, { "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY", "value": "true" } ], "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n export KBC_PD_RHSM_ORG=/activation-key/org\n export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n", "volumeMounts": [ { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/mnt/config", "name": "config" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/service-ca", "name": "service-ca", "readOnly": true } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf:a74227aa19d83f40f776ada6d909041cca68a655.prefetch", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source", "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "emptyDir": {}, "name": "config" }, { "configMap": { "items": [ { "key": "service-ca.crt", "path": "ca-bundle.crt" } ], "name": "openshift-service-ca.crt", "optional": true }, "name": "service-ca" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n", "name": "git-basic-auth", "optional": true }, { "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n", "name": "netrc", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw?rev=a74227aa19d83f40f776ada6d909041cca68a655", "build.appstudio.redhat.com/commit_sha": "a74227aa19d83f40f776ada6d909041cca68a655", "build.appstudio.redhat.com/target_branch": "base-qtcjej", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-qtcjej", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "85935561094", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "incoming", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-pasvim", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-puyp/pipelinerun/gh-test-custom-branch-nmitlf-on-push-mgtxr", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-qtcjej\"", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-nmitlf-on-push", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-devfile-sample-hello-world-suofaw", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "incoming", "pipelinesascode.tekton.dev/sha": "a74227aa19d83f40f776ada6d909041cca68a655", "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-test-custom-branch-nmitlf", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw/commit/a74227aa19d83f40f776ada6d909041cca68a655", "pipelinesascode.tekton.dev/source-branch": "base-qtcjej", "pipelinesascode.tekton.dev/source-repo-url": "", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-suofaw", "results.tekton.dev/record": "build-e2e-puyp/results/7e6c6eb0-912b-43da-b8d9-0f31bb19bad5/records/25596f74-dac7-4f2b-85c5-8e40ea1c8547", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-suofaw\",\"commit\":\"a74227aa19d83f40f776ada6d909041cca68a655\",\"eventType\":\"incoming\"}", "results.tekton.dev/result": "build-e2e-puyp/results/7e6c6eb0-912b-43da-b8d9-0f31bb19bad5", "results.tekton.dev/stored": "false", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux" }, "creationTimestamp": "2026-07-08T17:20:57Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-njag", "appstudio.openshift.io/component": "gh-test-custom-branch-nmitlf", "build.appstudio.redhat.com/build_type": "docker", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "85935561094", "pipelinesascode.tekton.dev/event-type": "incoming", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-nmitlf-on-push", "pipelinesascode.tekton.dev/repository": "thub-com-redhat-appstudio-qe-devfile-sample-hello-world-suofaw", "pipelinesascode.tekton.dev/sha": "a74227aa19d83f40f776ada6d909041cca68a655", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-suofaw", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gh-test-custom-branch-nmitlf-on-push-mgtxr", "tekton.dev/pipelineRun": "gh-test-custom-branch-nmitlf-on-push-mgtxr", "tekton.dev/pipelineRunUID": "7e6c6eb0-912b-43da-b8d9-0f31bb19bad5", "tekton.dev/pipelineTask": "build-container", "tekton.dev/task": "buildah-oci-ta-min" }, "name": "gh-test-custom-branch-nmitlf-on-push-mgtxr-build-container", "namespace": "build-e2e-puyp", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gh-test-custom-branch-nmitlf-on-push-mgtxr", "uid": "7e6c6eb0-912b-43da-b8d9-0f31bb19bad5" } ], "resourceVersion": "30130", "uid": "25596f74-dac7-4f2b-85c5-8e40ea1c8547" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf:a74227aa19d83f40f776ada6d909041cca68a655" }, { "name": "DOCKERFILE", "value": "docker/Dockerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "" }, { "name": "COMMIT_SHA", "value": "a74227aa19d83f40f776ada6d909041cca68a655" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "" }, { "name": "NO_PROXY", "value": "" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf@sha256:4b785b4fc6a99fff47fd3cdbe0c5ca820e5b1dceac738446493165ae596d8216" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "serviceAccountName": "build-pipeline-gh-test-custom-branch-nmitlf", "taskRef": { "params": [ { "name": "name", "value": "buildah-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "conditions": [ { "lastTransitionTime": "2026-07-08T17:21:00Z", "message": "pod status \"Ready\":\"False\"; message: \"containers with unready status: [step-use-trusted-artifact step-build step-push step-sbom-syft-generate step-prepare-sboms step-upload-sbom]\"", "reason": "Pending", "status": "Unknown", "type": "Succeeded" } ], "podName": "gh-test-custom-branch-nmitlf-on-push-mgtxr-build-container-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, "entryPoint": "buildah-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min" } }, "startTime": "2026-07-08T17:20:57Z", "steps": [ { "container": "step-use-trusted-artifact", "name": "use-trusted-artifact", "provenance": {}, "waiting": { "reason": "PodInitializing" } }, { "container": "step-build", "name": "build", "provenance": {}, "waiting": { "reason": "PodInitializing" } }, { "container": "step-push", "name": "push", "provenance": {}, "waiting": { "reason": "PodInitializing" } }, { "container": "step-sbom-syft-generate", "name": "sbom-syft-generate", "provenance": {}, "waiting": { "reason": "PodInitializing" } }, { "container": "step-prepare-sboms", "name": "prepare-sboms", "provenance": {}, "waiting": { "reason": "PodInitializing" } }, { "container": "step-upload-sbom", "name": "upload-sbom", "provenance": {}, "waiting": { "reason": "PodInitializing" } } ], "taskSpec": { "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": [], "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings", "name": "ADDITIONAL_BASE_IMAGES", "type": "array" }, { "default": "does-not-exist", "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET", "name": "ADDITIONAL_SECRET", "type": "string" }, { "default": "", "description": "Comma separated list of extra capabilities to add when running 'buildah build'", "name": "ADD_CAPABILITIES", "type": "string" }, { "default": [], "description": "Additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS", "type": "array" }, { "default": "", "description": "Path to a file with additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS_FILE", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings)", "name": "BUILD_ARGS", "type": "array" }, { "default": "", "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "BUILD_ARGS_FILE", "type": "string" }, { "default": "", "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.", "name": "BUILD_TIMESTAMP", "type": "string" }, { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "", "description": "The image is built from this commit.", "name": "COMMIT_SHA", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": "true", "description": "Determines if SBOM will be contextualized.", "name": "CONTEXTUALIZE_SBOM", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile to build.", "name": "DOCKERFILE", "type": "string" }, { "default": "etc-pki-entitlement", "description": "Name of secret which contains the entitlement certificates", "name": "ENTITLEMENT_SECRET", "type": "string" }, { "default": [], "description": "Array of --env values (\"env=value\" strings)", "name": "ENV_VARS", "type": "array" }, { "default": "false", "description": "Determines if build will be executed without network access.", "name": "HERMETIC", "type": "string" }, { "default": "", "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.", "name": "HTTP_PROXY", "type": "string" }, { "default": "true", "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection", "name": "ICM_KEEP_COMPAT_LOCATION", "type": "string" }, { "description": "Reference of the image buildah will produce.", "name": "IMAGE", "type": "string" }, { "default": "", "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "IMAGE_EXPIRES_AFTER", "type": "string" }, { "default": "true", "description": "Determines if the image inherits the base image labels.", "name": "INHERIT_BASE_IMAGE_LABELS", "type": "string" }, { "default": [], "description": "Additional key=value labels that should be applied to the image", "name": "LABELS", "type": "array" }, { "default": "", "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.", "name": "NO_PROXY", "type": "string" }, { "default": "false", "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.", "name": "OMIT_HISTORY", "type": "string" }, { "default": "", "description": "In case it is not empty, the prefetched content should be made available to the build.", "name": "PREFETCH_INPUT", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "PRIVILEGED_NESTED", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.", "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "caching-ca-bundle", "description": "The name of the ConfigMap to read proxy CA bundle data from.", "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "false", "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.", "name": "REWRITE_TIMESTAMP", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.", "name": "SBOM_SOURCE_SCAN_ENABLED", "type": "string" }, { "default": "", "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection", "name": "SBOM_SYFT_SELECT_CATALOGERS", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.", "name": "SBOM_TYPE", "type": "string" }, { "default": "false", "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.", "name": "SKIP_INJECTIONS", "type": "string" }, { "default": "false", "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled", "name": "SKIP_SBOM_GENERATION", "type": "string" }, { "default": "true", "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages", "name": "SKIP_UNUSED_STAGES", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "", "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.", "name": "SOURCE_DATE_EPOCH", "type": "string" }, { "default": "", "description": "The image is built from this URL.", "name": "SOURCE_URL", "type": "string" }, { "default": "false", "description": "Squash all new and previous layers added as a part of this build, as per --squash", "name": "SQUASH", "type": "string" }, { "default": "overlay", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "", "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.", "name": "TARGET_STAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "default": "", "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).", "name": "WORKINGDIR_MOUNT", "type": "string" }, { "default": "fetched.repos.d", "description": "Path in source workspace where dynamically-fetched repos are present", "name": "YUM_REPOS_D_FETCHED", "type": "string" }, { "default": "repos.d", "description": "Path in the git repository in which yum repository files are stored", "name": "YUM_REPOS_D_SRC", "type": "string" }, { "default": "/etc/yum.repos.d", "description": "Target path on the container in which yum repository files should be made available", "name": "YUM_REPOS_D_TARGET", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image reference of the built image", "name": "IMAGE_REF", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "ACTIVATION_KEY", "value": "activation-key" }, { "name": "ADDITIONAL_SECRET", "value": "does-not-exist" }, { "name": "ADD_CAPABILITIES" }, { "name": "ANNOTATIONS_FILE" }, { "name": "BUILD_ARGS_FILE" }, { "name": "BUILD_TIMESTAMP" }, { "name": "CONTEXT", "value": "." }, { "name": "CONTEXTUALIZE_SBOM", "value": "true" }, { "name": "ENTITLEMENT_SECRET", "value": "etc-pki-entitlement" }, { "name": "HERMETIC", "value": "false" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf:a74227aa19d83f40f776ada6d909041cca68a655" }, { "name": "IMAGE_EXPIRES_AFTER" }, { "name": "INHERIT_BASE_IMAGE_LABELS", "value": "true" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SBOM_SKIP_VALIDATION", "value": "true" }, { "name": "SBOM_SOURCE_SCAN_ENABLED", "value": "true" }, { "name": "SBOM_SYFT_SELECT_CATALOGERS" }, { "name": "SBOM_TYPE", "value": "spdx" }, { "name": "SKIP_INJECTIONS", "value": "false" }, { "name": "SKIP_SBOM_GENERATION", "value": "false" }, { "name": "SKIP_UNUSED_STAGES", "value": "true" }, { "name": "SOURCE_CODE_DIR", "value": "source" }, { "name": "SQUASH", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "overlay" }, { "name": "TARGET_STAGE" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "WORKINGDIR_MOUNT" }, { "name": "YUM_REPOS_D_FETCHED", "value": "fetched.repos.d" }, { "name": "YUM_REPOS_D_SRC", "value": "repos.d" }, { "name": "YUM_REPOS_D_TARGET", "value": "/etc/yum.repos.d" } ], "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf@sha256:4b785b4fc6a99fff47fd3cdbe0c5ca820e5b1dceac738446493165ae596d8216=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "--build-args", "--env", "--labels", "--annotations" ], "computeResources": { "limits": { "cpu": "500m", "memory": "1Gi" }, "requests": { "cpu": "500m", "memory": "1Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "COMMIT_SHA", "value": "a74227aa19d83f40f776ada6d909041cca68a655" }, { "name": "SOURCE_URL", "value": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw" }, { "name": "DOCKERFILE", "value": "docker/Dockerfile" }, { "name": "BUILDAH_HTTP_PROXY" }, { "name": "BUILDAH_NO_PROXY" }, { "name": "ICM_KEEP_COMPAT_LOCATION", "value": "true" }, { "name": "BUILDAH_OMIT_HISTORY", "value": "false" }, { "name": "BUILDAH_SOURCE_DATE_EPOCH" }, { "name": "BUILDAH_REWRITE_TIMESTAMP", "value": "false" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "build", "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n fi\n fi\n}\n\nfunction unset_proxy {\n echo \"[$(date --utc -Ins)] Unsetting proxy\"\n unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n # path is valid, do nothing\n ;;\n*)\n echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n echo \"Source path: $source_dir_path\" \u003e\u00262\n echo \"Resolved path: $context_dir_path\" \u003e\u00262\n exit 1\n ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n # Instrumented builds (SAST) use this custom dockerfile step as their base\n dockerfile_path=\"$DOCKERFILE\"\nelse\n echo \"Cannot find Dockerfile $DOCKERFILE\"\n exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n while IFS= read -r line || [[ -n \"$line\" ]]; do\n # Skip empty lines and comments\n if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n ANNOTATIONS+=(\"--annotation\" \"$line\")\n fi\n done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --build-args)\n shift\n # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n build_args+=(\"$1\")\n shift\n done\n ;;\n --env)\n shift\n # Collect env entries of the form KEY=value\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n env_vars+=(\"$1\")\n shift\n done\n ;;\n --labels)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n LABELS+=(\"--label\" \"$1\")\n shift\n done\n ;;\n --annotations)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ANNOTATIONS+=(\"--annotation\" \"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--pull=never\")\n UNSHARE_ARGS+=(\"--net\")\n buildah_retries=3\n\n set_proxy\n\n for image in $BASE_IMAGES; do\n if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n echo \"Failed to pull base image ${image}\"\n exit 1\n fi\n done\n\n unset_proxy\n\n echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n BUILDAH_ARGS+=(\"--cap-add=all\")\n BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n fi\n if [ -n \"$BUILD_TIMESTAMP\" ]; then\n echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n exit 1\n fi\n # but do set it so that we get all the labels/annotations associated with it\n BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n # Identify the current arch to filter the prefetched content\n PREFETCH_ARCH=\"$(uname -m)\"\n echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n echo \"Prefetched content will be made available\"\n\n cp -r \"/var/workdir/cachi2\" /tmp/\n chmod -R go+rwX /tmp/cachi2\n\n # In case RPMs were prefetched and this is a multi-arch build,\n # clean up the packages that do not match the architecture being built\n RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n echo \"Removing prefetched RPMs from non-matching architectures\"\n PREFETCH_ARCH=\"$(uname -m)\"\n for path in \"$RPM_PREFETCH_DIR\"/*; do\n if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n echo \"Removing: $path\"\n rm -rf \"$path\"\n else\n echo \"Keeping: $path\"\n fi\n done\n fi\n\n VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n sed -E -i \\\n -e 'H;1h;$!d;x' \\\n -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n @igM' \\\n \"$dockerfile_copy\"\n\n prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n mkdir -p \"$YUM_REPOS_D_FETCHED\"\n if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n fi\n fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n \"--label\" \"architecture=$(uname -m)\"\n \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n FINAL_BASE_IMAGE=$(\n # Get the base image of the final stage\n # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n # Run the find_root_stage() function on the final stage\n # If the final stage is scratch or oci-archive, return empty\n jq -r '.Stages as $all_stages |\n def find_root_stage($stage):\n if $stage.From.Stage then\n find_root_stage($all_stages[$stage.From.Stage.Index])\n else\n $stage\n end;\n\n find_root_stage(.Stages[-1]) |\n if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n empty\n else\n .BaseName\n end' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n )\n if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n set_proxy\n buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n unset_proxy\n buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n if [[ \"$label\" != \"--label\" ]]; then\n label_pairs+=(\"$label\")\n fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n echo \"\" \u003e\u003e\"$dockerfile_copy\"\n # Always write labels.json to the new standard location\n echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n # Conditionally write to the old location for backward compatibility\n if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n cp \"$containerignore\" \"$ignorefile_copy\"\n {\n echo \"\"\n echo \"!/labels.json\"\n echo \"!/content-sets.json\"\n } \u003e\u003e\"$ignorefile_copy\"\n BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n# to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n# shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n mkdir -p /shared/rhsm/etc/pki/entitlement\n mkdir -p /shared/rhsm/etc/pki/consumer\n\n VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n echo \"Adding activation key to the build\"\n\n if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n # user is not running registration in the Containerfile: pre-register.\n echo \"Pre-registering with subscription manager.\"\n export RETRY_MAX_TRIES=6\n if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n echo \"Subscription-manager register failed\"\n exit 1\n fi\n unset RETRY_MAX_TRIES\n trap 'subscription-manager unregister || true' EXIT\n\n # copy generated certificates to /shared volume\n cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n exit 1\n fi\n # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n # (we set the workdir using 'unshare -w')\n context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n # Instrumented builds (SAST) use this step as their base and add some other tools.\n while read -r volume_mount; do\n VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n while read -r filename; do\n echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n buildah build\n \"${VOLUME_MOUNTS[@]}\"\n \"${BUILDAH_ARGS[@]}\"\n \"${LABELS[@]}\"\n \"${ANNOTATIONS[@]}\"\n --tls-verify=\"$TLSVERIFY\" --no-cache\n --ulimit nofile=4096:4096\n --http-proxy=false\n -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n echo \"Making copy of sbom-prefetch.json\"\n cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n # Get the image pullspec and filter out a tag if it is not set\n # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n # if buildah did not use that particular image during build because it was skipped\n if [ -n \"$base_image_digest\" ]; then\n echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/entitlement", "name": "etc-pki-entitlement" }, { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/additional-secret", "name": "additional-secret" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/proxy-ca-bundle", "name": "proxy-ca-bundle", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "TASKRUN_NAME", "value": "gh-test-custom-branch-nmitlf-on-push-mgtxr-build-container" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "push", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n \"$IMAGE\" \\\n \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n \"docker://$IMAGE\"; then\n echo \"Failed to push image to $IMAGE\"\n exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n echo -n \"${IMAGE}@\"\n cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n [rekorInternalUrl]=REKOR_URL\n [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n [rekorInternalUrl]=rekorExternalUrl\n [fulcioInternalUrl]=fulcioExternalUrl\n [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n if [ -n \"${val}\" ]; then\n echo \"Using fallback ${fallback_key} instead of ${key}\"\n fi\n fi\n if [ -z \"${val}\" ]; then\n missing=\"${missing:+${missing}, }${key}\"\n else\n declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n configured=$((configured + 1))\n fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n echo \"Keyless signing is enabled\"\n\n # Save signing config for upload-sbom step\n for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n envvar=\"${SIGNING_KEY_MAP[$key]}\"\n printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n done \u003e/shared/signing-config.env\n\n echo \"Using Rekor URL: ${REKOR_URL}\"\n echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n echo \"[$(date --utc -Ins)] Sign image\"\n echo \"Signing image ${IMAGE_REF} using keyless signing\"\n if ! retry cosign sign -y \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign image\" \u003e\u00262\n exit 1\n fi\nelif [ \"${configured}\" -eq 0 ]; then\n echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "256m", "memory": "512Mi" }, "requests": { "cpu": "256m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n syft_sbom_type=cyclonedx-json@1.5\n ;;\nspdx)\n syft_sbom_type=spdx-json@2.3\n ;;\n*)\n echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n exit 1\n ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n oci-dir:\"${OCI_DIR}\"\n --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n echo \"Running syft on the source code\"\n syft \"${syft_source_args[@]}\"\nelse\n echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" }, { "args": [ "--additional-base-images" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --additional-base-images)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ADDITIONAL_BASE_IMAGES+=(\"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n generate\n --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-image\n --from-syft \"/var/workdir/sbom-image.json\"\n --image-pullspec \"$IMAGE_URL\"\n --image-digest \"$IMAGE_DIGEST\"\n --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n", "securityContext": { "runAsUser": 0 }, "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n # shellcheck source=/dev/null\n source /shared/signing-config.env\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n # spdx export data as rawstring, we want structured json as cyclonedx\n ATT_SBOM_TYPE=\"spdxjson\"\n fi\n\n echo \"[$(date --utc -Ins)] Sign SBOM\"\n echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign SBOM\" \u003e\u00262\n exit 1\n fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "name": "additional-secret", "secret": { "optional": true, "secretName": "does-not-exist" } }, { "name": "etc-pki-entitlement", "secret": { "optional": true, "secretName": "etc-pki-entitlement" } }, { "name": "oidc-token", "projected": { "sources": [ { "serviceAccountToken": { "audience": "sigstore", "expirationSeconds": 600, "path": "oidc-token" } } ] } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "caching-ca-bundle", "optional": true }, "name": "proxy-ca-bundle" }, { "emptyDir": {}, "name": "shared" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "varlibcontainers" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw?rev=a74227aa19d83f40f776ada6d909041cca68a655", "build.appstudio.redhat.com/commit_sha": "a74227aa19d83f40f776ada6d909041cca68a655", "build.appstudio.redhat.com/target_branch": "base-qtcjej", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-qtcjej", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "85935561094", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "incoming", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-pasvim", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-puyp/pipelinerun/gh-test-custom-branch-nmitlf-on-push-mgtxr", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-qtcjej\"", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-nmitlf-on-push", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-devfile-sample-hello-world-suofaw", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "incoming", "pipelinesascode.tekton.dev/sha": "a74227aa19d83f40f776ada6d909041cca68a655", "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-test-custom-branch-nmitlf", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw/commit/a74227aa19d83f40f776ada6d909041cca68a655", "pipelinesascode.tekton.dev/source-branch": "base-qtcjej", "pipelinesascode.tekton.dev/source-repo-url": "", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-suofaw", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-puyp/results/7e6c6eb0-912b-43da-b8d9-0f31bb19bad5/records/8cc5f721-3e91-4a36-bcf2-b25471b125b1", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-suofaw\",\"commit\":\"a74227aa19d83f40f776ada6d909041cca68a655\",\"eventType\":\"incoming\"}", "results.tekton.dev/result": "build-e2e-puyp/results/7e6c6eb0-912b-43da-b8d9-0f31bb19bad5", "results.tekton.dev/stored": "true", "tekton.dev/categories": "Git", "tekton.dev/displayName": "git clone oci trusted artifacts", "tekton.dev/pipelines.minVersion": "0.21.0", "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64", "tekton.dev/tags": "git" }, "creationTimestamp": "2026-07-08T17:20:02Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-njag", "appstudio.openshift.io/component": "gh-test-custom-branch-nmitlf", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "85935561094", "pipelinesascode.tekton.dev/event-type": "incoming", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-nmitlf-on-push", "pipelinesascode.tekton.dev/repository": "thub-com-redhat-appstudio-qe-devfile-sample-hello-world-suofaw", "pipelinesascode.tekton.dev/sha": "a74227aa19d83f40f776ada6d909041cca68a655", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-suofaw", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gh-test-custom-branch-nmitlf-on-push-mgtxr", "tekton.dev/pipelineRun": "gh-test-custom-branch-nmitlf-on-push-mgtxr", "tekton.dev/pipelineRunUID": "7e6c6eb0-912b-43da-b8d9-0f31bb19bad5", "tekton.dev/pipelineTask": "clone-repository", "tekton.dev/task": "git-clone-oci-ta-min" }, "name": "gh-test-custom-branch-nmitlf-on-push-mgtxr-clone-repository", "namespace": "build-e2e-puyp", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gh-test-custom-branch-nmitlf-on-push-mgtxr", "uid": "7e6c6eb0-912b-43da-b8d9-0f31bb19bad5" } ], "resourceVersion": "29770", "uid": "8cc5f721-3e91-4a36-bcf2-b25471b125b1" }, "spec": { "params": [ { "name": "url", "value": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw" }, { "name": "revision", "value": "a74227aa19d83f40f776ada6d909041cca68a655" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf:a74227aa19d83f40f776ada6d909041cca68a655.git" }, { "name": "ociArtifactExpiresAfter", "value": "" } ], "serviceAccountName": "build-pipeline-gh-test-custom-branch-nmitlf", "taskRef": { "params": [ { "name": "name", "value": "git-clone-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s", "workspaces": [ { "name": "basic-auth", "secret": { "secretName": "pac-gitauth-pasvim" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-07-08T17:20:11Z", "conditions": [ { "lastTransitionTime": "2026-07-08T17:20:11Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gh-test-custom-branch-nmitlf-on-push-mgtxr-clone-repository-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, "entryPoint": "git-clone-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min" } }, "results": [ { "name": "CHAINS-GIT_COMMIT", "type": "string", "value": "a74227aa19d83f40f776ada6d909041cca68a655" }, { "name": "CHAINS-GIT_URL", "type": "string", "value": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw" }, { "name": "commit", "type": "string", "value": "a74227aa19d83f40f776ada6d909041cca68a655" }, { "name": "commit-timestamp", "type": "string", "value": "1783530603" }, { "name": "short-commit", "type": "string", "value": "a74227a" }, { "name": "url", "type": "string", "value": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf@sha256:4b785b4fc6a99fff47fd3cdbe0c5ca820e5b1dceac738446493165ae596d8216" } ], "startTime": "2026-07-08T17:20:02Z", "steps": [ { "container": "step-clone", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "provenance": {}, "terminated": { "containerID": "containerd://fd03c96146107cc572850630e4d02d516cce62376986155160acc874cb89d545", "exitCode": 0, "finishedAt": "2026-07-08T17:20:07Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a74227aa19d83f40f776ada6d909041cca68a655\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw\",\"type\":1},{\"key\":\"commit\",\"value\":\"a74227aa19d83f40f776ada6d909041cca68a655\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1783530603\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a74227a\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:20:07Z" }, "terminationReason": "Completed" }, { "container": "step-symlink-check", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "provenance": {}, "terminated": { "containerID": "containerd://72eb036dea5886941f9297478ba238012016785754dd5aea91cdec254f01afd6", "exitCode": 0, "finishedAt": "2026-07-08T17:20:08Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a74227aa19d83f40f776ada6d909041cca68a655\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw\",\"type\":1},{\"key\":\"commit\",\"value\":\"a74227aa19d83f40f776ada6d909041cca68a655\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1783530603\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a74227a\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:20:08Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://fd18b50d2ddcc0c0c9ba6771606f53e47970622808e5d29f22fcc1443a0c6e3e", "exitCode": 0, "finishedAt": "2026-07-08T17:20:10Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"a74227aa19d83f40f776ada6d909041cca68a655\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf@sha256:4b785b4fc6a99fff47fd3cdbe0c5ca820e5b1dceac738446493165ae596d8216\",\"type\":1},{\"key\":\"commit\",\"value\":\"a74227aa19d83f40f776ada6d909041cca68a655\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1783530603\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"a74227a\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:20:08Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.", "params": [ { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "1", "description": "Perform a shallow clone, fetching only the most recent N commits.", "name": "depth", "type": "string" }, { "default": "true", "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n", "name": "enableSymlinkCheck", "type": "string" }, { "default": "false", "description": "Fetch all tags for the repo.", "name": "fetchTags", "type": "string" }, { "default": "", "description": "HTTP proxy server for non-SSL requests.", "name": "httpProxy", "type": "string" }, { "default": "", "description": "HTTPS proxy server for SSL requests.", "name": "httpsProxy", "type": "string" }, { "default": "", "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n", "name": "mergeSourceDepth", "type": "string" }, { "default": "", "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n", "name": "mergeSourceRepoUrl", "type": "string" }, { "default": "false", "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.", "name": "mergeTargetBranch", "type": "string" }, { "default": "", "description": "Opt out of proxying HTTP/HTTPS requests.", "name": "noProxy", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "", "description": "Refspec to fetch before checking out revision.", "name": "refspec", "type": "string" }, { "default": "", "description": "Revision to checkout. (branch, tag, sha, ref, etc...)", "name": "revision", "type": "string" }, { "default": "7", "description": "Length of short commit SHA", "name": "shortCommitLength", "type": "string" }, { "default": "", "description": "Define the directory patterns to match or exclude when performing a sparse checkout.", "name": "sparseCheckoutDirectories", "type": "string" }, { "default": "true", "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.", "name": "sslVerify", "type": "string" }, { "default": "", "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n", "name": "submodulePaths", "type": "string" }, { "default": "true", "description": "Initialize and fetch git submodules.", "name": "submodules", "type": "string" }, { "default": "main", "description": "The target branch to merge into the revision (if mergeTargetBranch is true).", "name": "targetBranch", "type": "string" }, { "description": "Repository URL to clone from.", "name": "url", "type": "string" }, { "default": "/tekton/home", "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n", "name": "userHome", "type": "string" }, { "default": "false", "description": "Log the commands that are executed during `git-clone`'s operation.", "name": "verbose", "type": "string" } ], "results": [ { "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_COMMIT", "type": "string" }, { "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_URL", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "description": "The precise commit SHA that was fetched by this Task.", "name": "commit", "type": "string" }, { "description": "The commit timestamp of the checkout", "name": "commit-timestamp", "type": "string" }, { "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).", "name": "merged_sha", "type": "string" }, { "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters", "name": "short-commit", "type": "string" }, { "description": "The precise URL that was fetched by this Task.", "name": "url", "type": "string" } ], "steps": [ { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "PARAM_URL", "value": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw" }, { "name": "PARAM_REVISION", "value": "a74227aa19d83f40f776ada6d909041cca68a655" }, { "name": "PARAM_REFSPEC" }, { "name": "PARAM_SUBMODULES", "value": "true" }, { "name": "PARAM_SUBMODULE_PATHS" }, { "name": "PARAM_DEPTH", "value": "1" }, { "name": "PARAM_SHORT_COMMIT_LENGTH", "value": "7" }, { "name": "PARAM_SSL_VERIFY", "value": "true" }, { "name": "PARAM_HTTP_PROXY" }, { "name": "PARAM_HTTPS_PROXY" }, { "name": "PARAM_NO_PROXY" }, { "name": "PARAM_VERBOSE", "value": "false" }, { "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES" }, { "name": "PARAM_USER_HOME", "value": "/tekton/home" }, { "name": "PARAM_FETCH_TAGS", "value": "false" }, { "name": "PARAM_MERGE_TARGET_BRANCH", "value": "false" }, { "name": "PARAM_TARGET_BRANCH", "value": "main" }, { "name": "PARAM_MERGE_SOURCE_REPO_URL" }, { "name": "PARAM_MERGE_SOURCE_DEPTH" }, { "name": "WORKSPACE_SSH_DIRECTORY_BOUND", "value": "false" }, { "name": "WORKSPACE_SSH_DIRECTORY_PATH" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND", "value": "true" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH", "value": "/workspace/basic-auth" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n # Compatibility with kubernetes.io/basic-auth secrets\n elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n else\n echo \"Unknown basic-auth workspace format\"\n exit 1\n fi\n chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n -url=\"${PARAM_URL}\" \\\n -revision=\"${PARAM_REVISION}\" \\\n -refspec=\"${PARAM_REFSPEC}\" \\\n -path=\"${CHECKOUT_DIR}\" \\\n -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n -submodules=\"${PARAM_SUBMODULES}\" \\\n -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n -depth=\"${PARAM_DEPTH}\" \\\n -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n # Determine if merging from a different repository or the same one\n if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n normalize_url() {\n echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n }\n\n NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n MERGE_REMOTE=\"origin\"\n else\n echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n echo \"Adding remote 'merge-source'...\"\n git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n MERGE_REMOTE=\"merge-source\"\n fi\n else\n echo \"Merging from the same repository (origin)\"\n MERGE_REMOTE=\"origin\"\n fi\n\n echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n else\n retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n fi\n\n echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n git config --global user.email \"tekton-git-clone@tekton.dev\"\n git config --global user.name \"Tekton Git Clone Task\"\n\n if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n echo \"--- Git Status ---\"\n git status\n echo \"------------------\"\n exit 1\n fi\n\n # Check if there are changes staged for commit\n if git diff --staged --quiet; then\n echo \"No diff was found, skipping merge...\" \u003e\u00262\n else\n echo \"Merge successful (no conflicts found), committing...\"\n if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n exit 1\n fi\n MERGED_SHA=$(git rev-parse HEAD)\n echo \"New HEAD after merge: ${MERGED_SHA}\"\n echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n fi\n\nelse\n echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n echo \"Fetching tags\"\n retry git fetch --tags\nfi\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "computeResources": {}, "env": [ { "name": "PARAM_ENABLE_SYMLINK_CHECK", "value": "true" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n while read -r symlink; do\n target=$(readlink -m \"$symlink\")\n if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n fi\n done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n return 1\n fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n echo \"Running symlink check\"\n check_symlinks\nfi\n", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-puyp/gh-test-custom-branch-nmitlf:a74227aa19d83f40f776ada6d909041cca68a655.git", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n", "name": "basic-auth", "optional": true }, { "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n", "name": "ssh-directory", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw?rev=a74227aa19d83f40f776ada6d909041cca68a655", "build.appstudio.redhat.com/commit_sha": "a74227aa19d83f40f776ada6d909041cca68a655", "build.appstudio.redhat.com/target_branch": "base-qtcjej", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-qtcjej", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "85935561094", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "incoming", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-pasvim", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-puyp/pipelinerun/gh-test-custom-branch-nmitlf-on-push-mgtxr", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-qtcjej\"", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-nmitlf-on-push", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-devfile-sample-hello-world-suofaw", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "incoming", "pipelinesascode.tekton.dev/sha": "a74227aa19d83f40f776ada6d909041cca68a655", "pipelinesascode.tekton.dev/sha-title": "Merge pull request #2 from redhat-appstudio-qe/konflux-gh-test-custom-branch-nmitlf", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/devfile-sample-hello-world-suofaw/commit/a74227aa19d83f40f776ada6d909041cca68a655", "pipelinesascode.tekton.dev/source-branch": "base-qtcjej", "pipelinesascode.tekton.dev/source-repo-url": "", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-suofaw", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-puyp/results/7e6c6eb0-912b-43da-b8d9-0f31bb19bad5/records/8615f0fe-e91f-45e2-a712-e2cef1b8e05c", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-suofaw\",\"commit\":\"a74227aa19d83f40f776ada6d909041cca68a655\",\"eventType\":\"incoming\"}", "results.tekton.dev/result": "build-e2e-puyp/results/7e6c6eb0-912b-43da-b8d9-0f31bb19bad5", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux" }, "creationTimestamp": "2026-07-08T17:19:56Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-njag", "appstudio.openshift.io/component": "gh-test-custom-branch-nmitlf", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/check-run-id": "85935561094", "pipelinesascode.tekton.dev/event-type": "incoming", "pipelinesascode.tekton.dev/original-prname": "gh-test-custom-branch-nmitlf-on-push", "pipelinesascode.tekton.dev/repository": "thub-com-redhat-appstudio-qe-devfile-sample-hello-world-suofaw", "pipelinesascode.tekton.dev/sha": "a74227aa19d83f40f776ada6d909041cca68a655", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-suofaw", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gh-test-custom-branch-nmitlf-on-push-mgtxr", "tekton.dev/pipelineRun": "gh-test-custom-branch-nmitlf-on-push-mgtxr", "tekton.dev/pipelineRunUID": "7e6c6eb0-912b-43da-b8d9-0f31bb19bad5", "tekton.dev/pipelineTask": "init", "tekton.dev/task": "init" }, "name": "gh-test-custom-branch-nmitlf-on-push-mgtxr-init", "namespace": "build-e2e-puyp", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gh-test-custom-branch-nmitlf-on-push-mgtxr", "uid": "7e6c6eb0-912b-43da-b8d9-0f31bb19bad5" } ], "resourceVersion": "29565", "uid": "8615f0fe-e91f-45e2-a712-e2cef1b8e05c" }, "spec": { "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "serviceAccountName": "build-pipeline-gh-test-custom-branch-nmitlf", "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-08T17:20:02Z", "conditions": [ { "lastTransitionTime": "2026-07-08T17:20:02Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gh-test-custom-branch-nmitlf-on-push-mgtxr-init-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, "entryPoint": "init", "uri": "quay.io/konflux-ci/tekton-catalog/task-init" } }, "results": [ { "name": "http-proxy", "type": "string", "value": "" }, { "name": "no-proxy", "type": "string", "value": "" } ], "startTime": "2026-07-08T17:19:56Z", "steps": [ { "container": "step-init", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init", "provenance": {}, "terminated": { "containerID": "containerd://b3ec8e7ab92780ebf8af1ea2ce0b3c2b1c42b6810a04313eba809e2a602439d6", "exitCode": 0, "finishedAt": "2026-07-08T17:20:00Z", "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:20:00Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.", "params": [ { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" } ], "results": [ { "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)", "name": "http-proxy", "type": "string" }, { "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)", "name": "no-proxy", "type": "string" } ], "steps": [ { "args": [ "--enable", "false" ], "command": [ "konflux-build-cli", "config", "cache-proxy" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "DEFAULT_HTTP_PROXY", "value": "squid.caching.svc.cluster.local:3128" }, { "name": "DEFAULT_NO_PROXY", "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai" }, { "name": "HTTP_PROXY_RESULTS_PATH", "value": "/tekton/results/http-proxy" }, { "name": "NO_PROXY_RESULTS_PATH", "value": "/tekton/results/no-proxy" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.redhat.com/nudged-components": "gh-multi-component-child-paai", "build.appstudio.redhat.com/nudging-commit": "build-nudge-parent-ucyioz?rev=0eb753ec22623eba6241b20a88539a48be3a1668", "build.appstudio.redhat.com/nudging-component": "gh-multi-component-parent-paai", "build.appstudio.redhat.com/nudging-image": "quay.io/redhat-appstudio-qe/build-e2e-syoa/gh-multi-component-parent-paai:0eb753ec22623eba6241b20a88539a48be3a1668", "build.appstudio.redhat.com/nudging-pipeline": "gh-multi-component-parent-paai-on-push-njbjb", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-syoa/results/5733a783-fa12-4688-afb6-0533075a8b57/records/1539237b-05da-4f9e-b64e-b311d616fba4", "results.tekton.dev/result": "build-e2e-syoa/results/5733a783-fa12-4688-afb6-0533075a8b57", "results.tekton.dev/stored": "true" }, "creationTimestamp": "2026-07-08T17:10:23Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "build.appstudio.redhat.com/type": "nudge", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-pipeline-1783530623-5f7fc", "tekton.dev/pipelineRun": "renovate-pipeline-1783530623-5f7fc", "tekton.dev/pipelineRunUID": "5733a783-fa12-4688-afb6-0533075a8b57", "tekton.dev/pipelineTask": "renovate" }, "name": "renovate-pipeline-1783530623-5f7fc-renovate", "namespace": "build-e2e-syoa", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-pipeline-1783530623-5f7fc", "uid": "5733a783-fa12-4688-afb6-0533075a8b57" } ], "resourceVersion": "24587", "uid": "1539237b-05da-4f9e-b64e-b311d616fba4" }, "spec": { "serviceAccountName": "build-pipeline-gh-multi-component-parent-paai", "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_5211c2fc3f RENOVATE_CONFIG_FILE=/configs/gh-multi-component-child-paai-bf1a9.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_syoa_gh_multi_component_parent_paai_7401f421fb','password':'${TOKEN_499775c456}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1783530623-5f7fc" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1783530623-5f7fc" } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1783530623-5f7fc" }, "name": "renovate-pipeline-1783530623-5f7fc" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-08T17:13:51Z", "conditions": [ { "lastTransitionTime": "2026-07-08T17:13:51Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "renovate-pipeline-1783530623-5f7fc-renovate-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-07-08T17:10:23Z", "steps": [ { "container": "step-renovate", "imageID": "quay.io/konflux-ci/mintmaker-renovate-image@sha256:67d26b20533790565a2949a3f732d595dda9378fea506f1cba88ca17cef13873", "name": "renovate", "provenance": {}, "terminated": { "containerID": "containerd://3818c379425e6585e97d17387230f621b1651b20188b8614f6d4755a0b6c2a90", "exitCode": 0, "finishedAt": "2026-07-08T17:13:49Z", "reason": "Completed", "startedAt": "2026-07-08T17:13:37Z" }, "terminationReason": "Completed" } ], "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_5211c2fc3f RENOVATE_CONFIG_FILE=/configs/gh-multi-component-child-paai-bf1a9.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_syoa_gh_multi_component_parent_paai_7401f421fb','password':'${TOKEN_499775c456}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1783530623-5f7fc" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1783530623-5f7fc" } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1783530623-5f7fc" }, "name": "renovate-pipeline-1783530623-5f7fc" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/sample-multi-component?rev=9a7fd1a74aa41f7d774f43456ce5f82870702729", "build.appstudio.redhat.com/commit_sha": "9a7fd1a74aa41f7d774f43456ce5f82870702729", "build.appstudio.redhat.com/pull_request_number": "34019", "build.appstudio.redhat.com/target_branch": "multi-component-base-iutlzs", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "multi-component-base-iutlzs", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85934985316", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ihhpxi", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-tgve/pipelinerun/go-component-ehwxie-on-pull-request-n65wc", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-base-iutlzs\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-ehwxie-pull-request.yaml\".pathChanged() )", "pipelinesascode.tekton.dev/original-prname": "go-component-ehwxie-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34019", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-e2e-tests[bot]", "pipelinesascode.tekton.dev/sha": "9a7fd1a74aa41f7d774f43456ce5f82870702729", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/sample-multi-component/commit/9a7fd1a74aa41f7d774f43456ce5f82870702729", "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-ehwxie", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "results.tekton.dev/record": "build-e2e-tgve/results/a439a8e2-a8d3-41d0-a5cd-dc36109b3aee/records/5857fb74-d58c-4752-9cd5-b8deddaa2731", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"sample-multi-component\",\"commit\":\"9a7fd1a74aa41f7d774f43456ce5f82870702729\",\"eventType\":\"pull_request\",\"pull_request-id\":34019}", "results.tekton.dev/result": "build-e2e-tgve/results/a439a8e2-a8d3-41d0-a5cd-dc36109b3aee", "results.tekton.dev/stored": "false", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "test.appstudio.openshift.io/pr-group": "konflux-go-component-ehwxie" }, "creationTimestamp": "2026-07-08T17:18:17Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-positive-mc-kgqk", "appstudio.openshift.io/component": "go-component-ehwxie", "build.appstudio.redhat.com/build_type": "docker", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85934985316", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "go-component-ehwxie-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34019", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/sha": "9a7fd1a74aa41f7d774f43456ce5f82870702729", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "go-component-ehwxie-on-pull-request-n65wc", "tekton.dev/pipelineRun": "go-component-ehwxie-on-pull-request-n65wc", "tekton.dev/pipelineRunUID": "a439a8e2-a8d3-41d0-a5cd-dc36109b3aee", "tekton.dev/pipelineTask": "build-container", "tekton.dev/task": "buildah-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "d7301c57dbefc6e4efa4787ae625d792dd665fb52c49e23edaa18a278322e0" }, "name": "go-component-ehwxie-on-pull-request-n65wc-build-container", "namespace": "build-e2e-tgve", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "go-component-ehwxie-on-pull-request-n65wc", "uid": "a439a8e2-a8d3-41d0-a5cd-dc36109b3aee" } ], "resourceVersion": "29689", "uid": "5857fb74-d58c-4752-9cd5-b8deddaa2731" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie:on-pr-9a7fd1a74aa41f7d774f43456ce5f82870702729" }, { "name": "DOCKERFILE", "value": "docker/Dockerfile" }, { "name": "CONTEXT", "value": "go-component" }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "5d" }, { "name": "COMMIT_SHA", "value": "9a7fd1a74aa41f7d774f43456ce5f82870702729" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "https://github.com/redhat-appstudio-qe/sample-multi-component" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "" }, { "name": "NO_PROXY", "value": "" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie@sha256:1582046614f5fead2028d48d1ab33b378d67bec6c2f1549cf804c7b7f0f64c73" }, { "name": "CACHI2_ARTIFACT", "value": "" } ], "serviceAccountName": "build-pipeline-go-component-ehwxie", "taskRef": { "params": [ { "name": "name", "value": "buildah-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min:0.9@sha256:97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "conditions": [ { "lastTransitionTime": "2026-07-08T17:18:23Z", "message": "Not all Steps in the Task have finished executing", "reason": "Running", "status": "Unknown", "type": "Succeeded" } ], "podName": "go-component-ehwxie-on-pull-request-n65wc-build-container-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "97c0d0ac1d508a70f8610c7dc79de453a990414fba7d7e0f8d21ec22f5796d96" }, "entryPoint": "buildah-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta-min" } }, "startTime": "2026-07-08T17:18:17Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://fa7de421c00a3013f0ddcfbcc47055e908bfe21f1ed11ee08d6f8a92cb82c69d", "exitCode": 0, "finishedAt": "2026-07-08T17:18:25Z", "reason": "Completed", "startedAt": "2026-07-08T17:18:24Z" }, "terminationReason": "Completed" }, { "container": "step-build", "imageID": "quay.io/konflux-ci/buildah-task@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "build", "provenance": {}, "terminated": { "containerID": "containerd://c6bc4557669f0c320858baeebbb51b125e3906738100c16204340de421ab8276", "exitCode": 0, "finishedAt": "2026-07-08T17:20:13Z", "reason": "Completed", "startedAt": "2026-07-08T17:18:26Z" }, "terminationReason": "Completed" }, { "container": "step-push", "imageID": "quay.io/konflux-ci/buildah-task@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "push", "provenance": {}, "running": { "startedAt": "2026-07-08T17:18:21Z" } }, { "container": "step-sbom-syft-generate", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "provenance": {}, "running": { "startedAt": "2026-07-08T17:18:21Z" } }, { "container": "step-prepare-sboms", "imageID": "quay.io/konflux-ci/mobster@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "provenance": {}, "running": { "startedAt": "2026-07-08T17:18:21Z" } }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "running": { "startedAt": "2026-07-08T17:18:22Z" } } ], "taskSpec": { "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": [], "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings", "name": "ADDITIONAL_BASE_IMAGES", "type": "array" }, { "default": "does-not-exist", "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET", "name": "ADDITIONAL_SECRET", "type": "string" }, { "default": "", "description": "Comma separated list of extra capabilities to add when running 'buildah build'", "name": "ADD_CAPABILITIES", "type": "string" }, { "default": [], "description": "Additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS", "type": "array" }, { "default": "", "description": "Path to a file with additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS_FILE", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings)", "name": "BUILD_ARGS", "type": "array" }, { "default": "", "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "BUILD_ARGS_FILE", "type": "string" }, { "default": "", "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.", "name": "BUILD_TIMESTAMP", "type": "string" }, { "default": "", "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "default": "", "description": "The image is built from this commit.", "name": "COMMIT_SHA", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": "true", "description": "Determines if SBOM will be contextualized.", "name": "CONTEXTUALIZE_SBOM", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile to build.", "name": "DOCKERFILE", "type": "string" }, { "default": "etc-pki-entitlement", "description": "Name of secret which contains the entitlement certificates", "name": "ENTITLEMENT_SECRET", "type": "string" }, { "default": [], "description": "Array of --env values (\"env=value\" strings)", "name": "ENV_VARS", "type": "array" }, { "default": "false", "description": "Determines if build will be executed without network access.", "name": "HERMETIC", "type": "string" }, { "default": "", "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.", "name": "HTTP_PROXY", "type": "string" }, { "default": "true", "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection", "name": "ICM_KEEP_COMPAT_LOCATION", "type": "string" }, { "description": "Reference of the image buildah will produce.", "name": "IMAGE", "type": "string" }, { "default": "", "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "IMAGE_EXPIRES_AFTER", "type": "string" }, { "default": "true", "description": "Determines if the image inherits the base image labels.", "name": "INHERIT_BASE_IMAGE_LABELS", "type": "string" }, { "default": [], "description": "Additional key=value labels that should be applied to the image", "name": "LABELS", "type": "array" }, { "default": "", "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.", "name": "NO_PROXY", "type": "string" }, { "default": "false", "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.", "name": "OMIT_HISTORY", "type": "string" }, { "default": "", "description": "In case it is not empty, the prefetched content should be made available to the build.", "name": "PREFETCH_INPUT", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "PRIVILEGED_NESTED", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.", "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "caching-ca-bundle", "description": "The name of the ConfigMap to read proxy CA bundle data from.", "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "false", "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.", "name": "REWRITE_TIMESTAMP", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.", "name": "SBOM_SOURCE_SCAN_ENABLED", "type": "string" }, { "default": "", "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection", "name": "SBOM_SYFT_SELECT_CATALOGERS", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.", "name": "SBOM_TYPE", "type": "string" }, { "default": "false", "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.", "name": "SKIP_INJECTIONS", "type": "string" }, { "default": "false", "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled", "name": "SKIP_SBOM_GENERATION", "type": "string" }, { "default": "true", "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages", "name": "SKIP_UNUSED_STAGES", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "", "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.", "name": "SOURCE_DATE_EPOCH", "type": "string" }, { "default": "", "description": "The image is built from this URL.", "name": "SOURCE_URL", "type": "string" }, { "default": "false", "description": "Squash all new and previous layers added as a part of this build, as per --squash", "name": "SQUASH", "type": "string" }, { "default": "overlay", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "", "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.", "name": "TARGET_STAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "default": "", "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).", "name": "WORKINGDIR_MOUNT", "type": "string" }, { "default": "fetched.repos.d", "description": "Path in source workspace where dynamically-fetched repos are present", "name": "YUM_REPOS_D_FETCHED", "type": "string" }, { "default": "repos.d", "description": "Path in the git repository in which yum repository files are stored", "name": "YUM_REPOS_D_SRC", "type": "string" }, { "default": "/etc/yum.repos.d", "description": "Target path on the container in which yum repository files should be made available", "name": "YUM_REPOS_D_TARGET", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image reference of the built image", "name": "IMAGE_REF", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "ACTIVATION_KEY", "value": "activation-key" }, { "name": "ADDITIONAL_SECRET", "value": "does-not-exist" }, { "name": "ADD_CAPABILITIES" }, { "name": "ANNOTATIONS_FILE" }, { "name": "BUILD_ARGS_FILE" }, { "name": "BUILD_TIMESTAMP" }, { "name": "CONTEXT", "value": "go-component" }, { "name": "CONTEXTUALIZE_SBOM", "value": "true" }, { "name": "ENTITLEMENT_SECRET", "value": "etc-pki-entitlement" }, { "name": "HERMETIC", "value": "false" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie:on-pr-9a7fd1a74aa41f7d774f43456ce5f82870702729" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "5d" }, { "name": "INHERIT_BASE_IMAGE_LABELS", "value": "true" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SBOM_SKIP_VALIDATION", "value": "true" }, { "name": "SBOM_SOURCE_SCAN_ENABLED", "value": "true" }, { "name": "SBOM_SYFT_SELECT_CATALOGERS" }, { "name": "SBOM_TYPE", "value": "spdx" }, { "name": "SKIP_INJECTIONS", "value": "false" }, { "name": "SKIP_SBOM_GENERATION", "value": "false" }, { "name": "SKIP_UNUSED_STAGES", "value": "true" }, { "name": "SOURCE_CODE_DIR", "value": "source" }, { "name": "SQUASH", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "overlay" }, { "name": "TARGET_STAGE" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "WORKINGDIR_MOUNT" }, { "name": "YUM_REPOS_D_FETCHED", "value": "fetched.repos.d" }, { "name": "YUM_REPOS_D_SRC", "value": "repos.d" }, { "name": "YUM_REPOS_D_TARGET", "value": "/etc/yum.repos.d" } ], "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie@sha256:1582046614f5fead2028d48d1ab33b378d67bec6c2f1549cf804c7b7f0f64c73=/var/workdir/source", "=/var/workdir/cachi2" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "--build-args", "--env", "--labels", "--annotations" ], "computeResources": { "limits": { "cpu": "500m", "memory": "1Gi" }, "requests": { "cpu": "500m", "memory": "1Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "COMMIT_SHA", "value": "9a7fd1a74aa41f7d774f43456ce5f82870702729" }, { "name": "SOURCE_URL", "value": "https://github.com/redhat-appstudio-qe/sample-multi-component" }, { "name": "DOCKERFILE", "value": "docker/Dockerfile" }, { "name": "BUILDAH_HTTP_PROXY" }, { "name": "BUILDAH_NO_PROXY" }, { "name": "ICM_KEEP_COMPAT_LOCATION", "value": "true" }, { "name": "BUILDAH_OMIT_HISTORY", "value": "false" }, { "name": "BUILDAH_SOURCE_DATE_EPOCH" }, { "name": "BUILDAH_REWRITE_TIMESTAMP", "value": "false" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "build", "script": "#!/bin/bash\nset -euo pipefail\n\nfunction set_proxy {\n if [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Setting proxy to ${BUILDAH_HTTP_PROXY}\"\n export HTTP_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export HTTPS_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n export ALL_PROXY=\"${BUILDAH_HTTP_PROXY}\"\n if [ -n \"${BUILDAH_NO_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Bypassing proxy for ${BUILDAH_NO_PROXY}\"\n export NO_PROXY=\"${BUILDAH_NO_PROXY}\"\n fi\n fi\n}\n\nfunction unset_proxy {\n echo \"[$(date --utc -Ins)] Unsetting proxy\"\n unset HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY\n}\n\necho \"[$(date --utc -Ins)] Validate context path\"\n\nif [ -z \"$CONTEXT\" ]; then\n echo \"WARNING: CONTEXT is empty. Defaulting to '.' (the source directory).\" \u003e\u00262\n CONTEXT=\".\"\nfi\n\nsource_dir_path=$(realpath \"$SOURCE_CODE_DIR\")\ncontext_dir_path=$(realpath \"$SOURCE_CODE_DIR/$CONTEXT\")\n\ncase \"$context_dir_path\" in\n\"$source_dir_path\" | \"$source_dir_path/\"*)\n # path is valid, do nothing\n ;;\n*)\n echo \"ERROR: The CONTEXT parameter ('$CONTEXT') is invalid because it escapes the source directory.\" \u003e\u00262\n echo \"Source path: $source_dir_path\" \u003e\u00262\n echo \"Resolved path: $context_dir_path\" \u003e\u00262\n exit 1\n ;;\nesac\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare Dockerfile\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelif [ -e \"$DOCKERFILE\" ]; then\n # Instrumented builds (SAST) use this custom dockerfile step as their base\n dockerfile_path=\"$DOCKERFILE\"\nelse\n echo \"Cannot find Dockerfile $DOCKERFILE\"\n exit 1\nfi\n\ndockerfile_copy=$(mktemp --tmpdir \"$(basename \"$dockerfile_path\").XXXXXX\")\ncp \"$dockerfile_path\" \"$dockerfile_copy\"\n\n# Inject the image content manifest into the container we are producing.\n# This will generate the content-sets.json file and copy it by appending a COPY\n# instruction to the Containerfile.\nicm_opts=()\nif [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n icm_opts+=(-c)\nfi\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n inject-icm-to-containerfile \"${icm_opts[@]}\" \"$dockerfile_copy\" \"/var/workdir/cachi2/output/bom.json\" \"$SOURCE_CODE_DIR/$CONTEXT\"\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e/etc/subgid\n\nbuild_args=()\nenv_vars=()\n\nLABELS=()\nANNOTATIONS=()\n# Append any annotations from the specified file\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n echo \"Reading annotations from file: ${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\n while IFS= read -r line || [[ -n \"$line\" ]]; do\n # Skip empty lines and comments\n if [[ -n \"$line\" \u0026\u0026 ! \"$line\" =~ ^[[:space:]]*# ]]; then\n ANNOTATIONS+=(\"--annotation\" \"$line\")\n fi\n done \u003c\"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\"\nfi\n\n# Split `args` into two sets of arguments.\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --build-args)\n shift\n # Note: this may result in multiple --build-arg=KEY=value flags with the same KEY being\n # passed to buildah. In that case, the *last* occurrence takes precedence. This is why\n # we append BUILD_ARGS after the content of the BUILD_ARGS_FILE\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n build_args+=(\"$1\")\n shift\n done\n ;;\n --env)\n shift\n # Collect env entries of the form KEY=value\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n env_vars+=(\"$1\")\n shift\n done\n ;;\n --labels)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n LABELS+=(\"--label\" \"$1\")\n shift\n done\n ;;\n --annotations)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ANNOTATIONS+=(\"--annotation\" \"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nBUILD_ARG_FLAGS=()\nfor build_arg in \"${build_args[@]}\"; do\n BUILD_ARG_FLAGS+=(\"--build-arg=$build_arg\")\ndone\n\nENV_FLAGS=()\nfor env_var in \"${env_vars[@]}\"; do\n ENV_FLAGS+=(\"--env=$env_var\")\ndone\n\nDOCKERFILE_ARG_FLAGS=()\nDOCKERFILE_ARG_FLAGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nDOCKERFILE_ARG_FLAGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n DOCKERFILE_ARG_FLAGS+=(\"--build-arg-file=${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\ndockerfile-json \"${DOCKERFILE_ARG_FLAGS[@]}\" \"$dockerfile_copy\" \u003e/shared/parsed_dockerfile.json\nBASE_IMAGES=$(\n jq -r '.Stages[] | select(.From | .Stage or .Scratch | not) | .BaseName | select(test(\"^oci-archive:\") | not)' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n)\n\nBUILDAH_ARGS=()\nUNSHARE_ARGS=()\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--pull=never\")\n UNSHARE_ARGS+=(\"--net\")\n buildah_retries=3\n\n set_proxy\n\n for image in $BASE_IMAGES; do\n if ! retry unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 --mount -- buildah pull --retry \"$buildah_retries\" \"$image\"; then\n echo \"Failed to pull base image ${image}\"\n exit 1\n fi\n done\n\n unset_proxy\n\n echo \"Build will be executed with network isolation\"\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n BUILDAH_ARGS+=(\"--target=${TARGET_STAGE}\")\nfi\n\nBUILDAH_ARGS+=(\"${BUILD_ARG_FLAGS[@]}\")\nBUILDAH_ARGS+=(\"${ENV_FLAGS[@]}\")\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n BUILDAH_ARGS+=(\"--build-arg-file=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nBUILDAH_ARGS+=(\"--security-opt=unmask=/proc/interrupts\")\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--security-opt=label=disable\")\n BUILDAH_ARGS+=(\"--cap-add=all\")\n BUILDAH_ARGS+=(\"--device=/dev/fuse\")\nfi\n\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n BUILDAH_ARGS+=(\"--cap-add=${ADD_CAPABILITIES}\")\nfi\n\nif [ \"${SQUASH}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--squash\")\nfi\n\nif [ \"${SKIP_UNUSED_STAGES}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--skip-unused-stages=false\")\nfi\n\nif [ \"${INHERIT_BASE_IMAGE_LABELS}\" != \"true\" ]; then\n BUILDAH_ARGS+=(\"--inherit-labels=false\")\nfi\n\nif [ -n \"${BUILDAH_SOURCE_DATE_EPOCH}\" ]; then\n BUILDAH_ARGS+=(\"--source-date-epoch=${BUILDAH_SOURCE_DATE_EPOCH}\")\n if [ \"${BUILDAH_REWRITE_TIMESTAMP}\" = \"true\" ]; then\n BUILDAH_ARGS+=(\"--rewrite-timestamp\")\n fi\n if [ -n \"$BUILD_TIMESTAMP\" ]; then\n echo \"ERROR: cannot use both BUILD_TIMESTAMP and SOURCE_DATE_EPOCH\"\n exit 1\n fi\n # but do set it so that we get all the labels/annotations associated with it\n BUILD_TIMESTAMP=\"$BUILDAH_SOURCE_DATE_EPOCH\"\nfi\n\nif [ \"${BUILDAH_OMIT_HISTORY}\" == \"true\" ]; then\n BUILDAH_ARGS+=(\"--omit-history\")\nfi\n\nVOLUME_MOUNTS=()\n\necho \"[$(date --utc -Ins)] Setup prefetched\"\n\nif [ -f \"/var/workdir/cachi2/cachi2.env\" ]; then\n # Identify the current arch to filter the prefetched content\n PREFETCH_ARCH=\"$(uname -m)\"\n echo \"$PREFETCH_ARCH\" \u003e/shared/prefetch-arch\n\n echo \"Prefetched content will be made available\"\n\n cp -r \"/var/workdir/cachi2\" /tmp/\n chmod -R go+rwX /tmp/cachi2\n\n # In case RPMs were prefetched and this is a multi-arch build,\n # clean up the packages that do not match the architecture being built\n RPM_PREFETCH_DIR=\"/tmp/cachi2/output/deps/rpm\"\n if [ -d \"$RPM_PREFETCH_DIR\" ] \u0026\u0026 [ \"$(find $RPM_PREFETCH_DIR | wc -l)\" -gt 1 ]; then\n echo \"Removing prefetched RPMs from non-matching architectures\"\n PREFETCH_ARCH=\"$(uname -m)\"\n for path in \"$RPM_PREFETCH_DIR\"/*; do\n if [ \"$(basename \"$path\")\" != \"$PREFETCH_ARCH\" ]; then\n echo \"Removing: $path\"\n rm -rf \"$path\"\n else\n echo \"Keeping: $path\"\n fi\n done\n fi\n\n VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)\n # Read in the whole file (https://unix.stackexchange.com/questions/533277), then\n # for each RUN ... line insert the cachi2.env command *after* any options like --mount\n sed -E -i \\\n -e 'H;1h;$!d;x' \\\n -e 's@^\\s*(run((\\s|\\\\\\n)+-\\S+)*(\\s|\\\\\\n)+)@\\1. /cachi2/cachi2.env \\\u0026\\\u0026 \\\\\\n @igM' \\\n \"$dockerfile_copy\"\n\n prefetched_repo_for_my_arch=\"/tmp/cachi2/output/deps/rpm/$(uname -m)/repos.d/cachi2.repo\"\n if [ -f \"$prefetched_repo_for_my_arch\" ]; then\n echo \"Adding $prefetched_repo_for_my_arch to $YUM_REPOS_D_FETCHED\"\n mkdir -p \"$YUM_REPOS_D_FETCHED\"\n if [ ! -f \"${YUM_REPOS_D_FETCHED}/cachi2.repo\" ]; then\n cp \"$prefetched_repo_for_my_arch\" \"$YUM_REPOS_D_FETCHED\"\n fi\n fi\nfi\n\n# if yum repofiles stored in git, copy them to mount point outside the source dir\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n mkdir -p \"${YUM_REPOS_D_FETCHED}\"\n cp -r \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\"/* \"${YUM_REPOS_D_FETCHED}\"\nfi\n\n# if anything in the repofiles mount point (either fetched or from git), mount it\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n chmod -R go+rwX \"${YUM_REPOS_D_FETCHED}\"\n mount_point=$(realpath \"${YUM_REPOS_D_FETCHED}\")\n VOLUME_MOUNTS+=(--volume \"${mount_point}:${YUM_REPOS_D_TARGET}\")\nfi\n\nDEFAULT_LABELS=(\n \"--label\" \"architecture=$(uname -m)\"\n \"--label\" \"vcs-type=git\"\n)\nif [ -n \"$COMMIT_SHA\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"vcs-ref=${COMMIT_SHA}\" \"--label\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.revision=${COMMIT_SHA}\")\nfi\nif [ -n \"$SOURCE_URL\" ]; then\n DEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.source=${SOURCE_URL}\")\n ANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.source=${SOURCE_URL}\")\nfi\n[ -n \"$IMAGE_EXPIRES_AFTER\" ] \u0026\u0026 DEFAULT_LABELS+=(\"--label\" \"quay.expires-after=$IMAGE_EXPIRES_AFTER\")\n\nBUILD_TIMESTAMP_RFC3339=\"\"\nif [ -n \"$BUILD_TIMESTAMP\" ]; then\n BUILD_TIMESTAMP_RFC3339=$(date -u -d \"@$BUILD_TIMESTAMP\" +'%Y-%m-%dT%H:%M:%SZ')\nelse\n BUILD_TIMESTAMP_RFC3339=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\nfi\n\nDEFAULT_LABELS+=(\"--label\" \"build-date=${BUILD_TIMESTAMP_RFC3339}\")\nDEFAULT_LABELS+=(\"--label\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nANNOTATIONS+=(\"--annotation\" \"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\n\nlabel_pairs=()\n# If INHERIT_BASE_IMAGE_LABELS is true, get the labels from the final base image only\ntouch base_images_labels.json\nif [[ \"$INHERIT_BASE_IMAGE_LABELS\" == \"true\" ]] \u0026\u0026 [[ -n \"$BASE_IMAGES\" ]]; then\n FINAL_BASE_IMAGE=$(\n # Get the base image of the final stage\n # The final stage can refer to a previous `FROM xxx AS yyy` stage, for example 'FROM bar AS foo; ... ; FROM foo; ...'\n # Define a function that keeps nesting recursively into the parent stages until it finds the original base image\n # Run the find_root_stage() function on the final stage\n # If the final stage is scratch or oci-archive, return empty\n jq -r '.Stages as $all_stages |\n def find_root_stage($stage):\n if $stage.From.Stage then\n find_root_stage($all_stages[$stage.From.Stage.Index])\n else\n $stage\n end;\n\n find_root_stage(.Stages[-1]) |\n if .From.Scratch or (.BaseName | test(\"^oci-archive:\")) then\n empty\n else\n .BaseName\n end' /shared/parsed_dockerfile.json |\n tr -d '\"' |\n tr -d \"'\"\n )\n if [[ -n \"$FINAL_BASE_IMAGE\" ]]; then\n set_proxy\n buildah pull \"$FINAL_BASE_IMAGE\" \u003e/dev/null$()\n unset_proxy\n buildah inspect \"$FINAL_BASE_IMAGE\" | jq '.OCIv1.config.Labels' \u003e\"base_images_labels.json\"\n fi\nfi\n\n# Concatenate defaults and explicit labels. If a label appears twice, the last one wins.\nLABELS=(\"${DEFAULT_LABELS[@]}\" \"${LABELS[@]}\")\n\n# Get all the default and explicit labels so that they can be written into labels.json\nfor label in \"${LABELS[@]}\"; do\n if [[ \"$label\" != \"--label\" ]]; then\n label_pairs+=(\"$label\")\n fi\ndone\n\n# Labels that we explicitly add to the image\nlabel_pairs+=(\"org.opencontainers.image.created=${BUILD_TIMESTAMP_RFC3339}\")\nlabel_pairs+=(\"io.buildah.version=$(buildah version --json | jq -r '.version')\")\n\nwhile IFS= read -r label; do\n label_pairs+=(\"$label\")\ndone \u003c \u003c(jq -r '.Stages[].Commands[] | select(.Name == \"LABEL\") | .Labels[] | \"\\(.Key)=\\(.Value)\"' /shared/parsed_dockerfile.json | sed 's/\"//g')\n\nprintf '%s\\n' \"${label_pairs[@]}\" | jq -Rn '\n [ inputs | select(length\u003e0) ]\n| map( split(\"=\") | {(.[0]): (.[1] // \"\")} )\n | add' \u003e\"image_labels.json\"\n\njq -s '(.[0] // {}) * (.[1] // {})' \"base_images_labels.json\" \"image_labels.json\" \u003e\"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\njq '.' \"$SOURCE_CODE_DIR/$CONTEXT/labels.json\"\n\nif [ \"${SKIP_INJECTIONS}\" = \"false\" ]; then\n echo \"\" \u003e\u003e\"$dockerfile_copy\"\n # Always write labels.json to the new standard location\n echo 'COPY labels.json /usr/share/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n # Conditionally write to the old location for backward compatibility\n if [ \"${ICM_KEEP_COMPAT_LOCATION}\" = \"true\" ]; then\n echo 'COPY labels.json /root/buildinfo/labels.json' \u003e\u003e\"$dockerfile_copy\"\n fi\nfi\n\n# Make sure our labels.json file isn't filtered out\ncontainerignore=\"\"\nif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.containerignore\"\nelif [ -f \"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\" ]; then\n containerignore=\"$SOURCE_CODE_DIR/$CONTEXT/.dockerignore\"\nfi\n\nif [ -n \"$containerignore\" ]; then\n ignorefile_copy=$(mktemp --tmpdir \"$(basename \"$containerignore\").XXXXXX\")\n cp \"$containerignore\" \"$ignorefile_copy\"\n {\n echo \"\"\n echo \"!/labels.json\"\n echo \"!/content-sets.json\"\n } \u003e\u003e\"$ignorefile_copy\"\n BUILDAH_ARGS+=(--ignorefile \"$ignorefile_copy\")\nfi\n\necho \"[$(date --utc -Ins)] Register sub-man\"\n\nACTIVATION_KEY_PATH=\"/activation-key\"\nENTITLEMENT_PATH=\"/entitlement\"\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both vars are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 3. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n# to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n# shared emptydir volume to \"/etc/pki/entitlement\" to prevent certificates from being included\n\nif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 [ -e /activation-key/org ]; then\n cp -r --preserve=mode \"$ACTIVATION_KEY_PATH\" /tmp/activation-key\n mkdir -p /shared/rhsm/etc/pki/entitlement\n mkdir -p /shared/rhsm/etc/pki/consumer\n\n VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key\n -v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z\n -v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)\n echo \"Adding activation key to the build\"\n\n if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n # user is not running registration in the Containerfile: pre-register.\n echo \"Pre-registering with subscription manager.\"\n export RETRY_MAX_TRIES=6\n if ! retry subscription-manager register --org \"$(cat /tmp/activation-key/org)\" --activationkey \"$(cat /tmp/activation-key/activationkey)\"; then\n echo \"Subscription-manager register failed\"\n exit 1\n fi\n unset RETRY_MAX_TRIES\n trap 'subscription-manager unregister || true' EXIT\n\n # copy generated certificates to /shared volume\n cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement\n cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer\n\n # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca\n VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)\n fi\n\nelif [ \"${HERMETIC}\" != \"true\" ] \u0026\u0026 find /entitlement -name \"*.pem\" \u003e/dev/null; then\n cp -r --preserve=mode \"$ENTITLEMENT_PATH\" /tmp/entitlement\n VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)\n echo \"Adding the entitlement to the build\"\nfi\n\nif [ -n \"$WORKINGDIR_MOUNT\" ]; then\n if [[ \"$WORKINGDIR_MOUNT\" == *:* ]]; then\n echo \"WORKINGDIR_MOUNT contains ':'\" \u003e\u00262\n echo \"Refusing to proceed in case this is an attempt to set unexpected mount options.\" \u003e\u00262\n exit 1\n fi\n # ${SOURCE_CODE_DIR}/${CONTEXT} will be the $PWD when we call 'buildah build'\n # (we set the workdir using 'unshare -w')\n context_dir=$(realpath \"${SOURCE_CODE_DIR}/${CONTEXT}\")\n VOLUME_MOUNTS+=(--volume \"$context_dir:${WORKINGDIR_MOUNT}\")\nfi\n\nif [ -n \"${ADDITIONAL_VOLUME_MOUNTS-}\" ]; then\n # ADDITIONAL_VOLUME_MOUNTS allows to specify more volumes for the build.\n # Instrumented builds (SAST) use this step as their base and add some other tools.\n while read -r volume_mount; do\n VOLUME_MOUNTS+=(\"--volume=$volume_mount\")\n done \u003c\u003c\u003c\"$ADDITIONAL_VOLUME_MOUNTS\"\nfi\n\necho \"[$(date --utc -Ins)] Add secrets\"\n\nADDITIONAL_SECRET_PATH=\"/additional-secret\"\nADDITIONAL_SECRET_TMP=\"/tmp/additional-secret\"\nif [ -d \"$ADDITIONAL_SECRET_PATH\" ]; then\n cp -r --preserve=mode -L \"$ADDITIONAL_SECRET_PATH\" $ADDITIONAL_SECRET_TMP\n while read -r filename; do\n echo \"Adding the secret ${ADDITIONAL_SECRET}/${filename} to the build, available at /run/secrets/${ADDITIONAL_SECRET}/${filename}\"\n BUILDAH_ARGS+=(\"--secret=id=${ADDITIONAL_SECRET}/${filename},src=$ADDITIONAL_SECRET_TMP/${filename}\")\n done \u003c \u003c(find $ADDITIONAL_SECRET_TMP -maxdepth 1 -type f -exec basename {} \\;)\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\nbuildah_cmd_array=(\n buildah build\n \"${VOLUME_MOUNTS[@]}\"\n \"${BUILDAH_ARGS[@]}\"\n \"${LABELS[@]}\"\n \"${ANNOTATIONS[@]}\"\n --tls-verify=\"$TLSVERIFY\" --no-cache\n --ulimit nofile=4096:4096\n --http-proxy=false\n -f \"$dockerfile_copy\" -t \"$IMAGE\" .\n)\nbuildah_cmd=$(printf \"%q \" \"${buildah_cmd_array[@]}\")\n\nif [ \"${HERMETIC}\" == \"true\" ]; then\n # enabling loopback adapter enables Bazel builds to work in hermetic mode.\n command=\"ip link set lo up \u0026\u0026 $buildah_cmd\"\nelse\n command=\"$buildah_cmd\"\nfi\n\n# disable host subcription manager integration\nfind /usr/share/rhel/secrets -type l -exec unlink {} \\;\n\nset_proxy\n\necho \"[$(date --utc -Ins)] Run buildah build\"\necho \"[$(date --utc -Ins)] ${command}\"\n\nunshare -Uf \"${UNSHARE_ARGS[@]}\" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w \"${SOURCE_CODE_DIR}/$CONTEXT\" --mount -- sh -c \"$command\"\n\nunset_proxy\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"/tmp/cachi2/output/bom.json\" ]; then\n echo \"Making copy of sbom-prefetch.json\"\n cp /tmp/cachi2/output/bom.json ./sbom-prefetch.json\nfi\n\ntouch /shared/base_images_digests\necho \"Recording base image digests used\"\nfor image in $BASE_IMAGES; do\n # Get the image pullspec and filter out a tag if it is not set\n # Use head -n 1 to ensure we only get one result even if multiple images match the filter\n base_image_digest=$(buildah images --format '{{ .Name }}{{ if ne .Tag \"\u003cnone\u003e\" }}:{{ .Tag }}{{ end }}@{{ .Digest }}' --filter reference=\"$image\" | head -n 1)\n # In some cases, there might be BASE_IMAGES, but not any associated digest. This happens\n # if buildah did not use that particular image during build because it was skipped\n if [ -n \"$base_image_digest\" ]; then\n echo \"$image $base_image_digest\" | tee -a /shared/base_images_digests\n fi\ndone\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e/shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/entitlement", "name": "etc-pki-entitlement" }, { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/additional-secret", "name": "additional-secret" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/proxy-ca-bundle", "name": "proxy-ca-bundle", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "TASKRUN_NAME", "value": "go-component-ehwxie-on-pull-request-n65wc-build-container" } ], "image": "quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709", "name": "push", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n \"$IMAGE\" \\\n \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"; then\n echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --digestfile \"/var/workdir/image-digest\" \"$IMAGE\" \\\n \"docker://$IMAGE\"; then\n echo \"Failed to push image to $IMAGE\"\n exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c\"/var/workdir\"/image-digest\necho -n \"$IMAGE\" | tee /tekton/results/IMAGE_URL\n{\n echo -n \"${IMAGE}@\"\n cat \"/var/workdir/image-digest\"\n} \u003e\"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"; then\n echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n [rekorInternalUrl]=REKOR_URL\n [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n [rekorInternalUrl]=rekorExternalUrl\n [fulcioInternalUrl]=fulcioExternalUrl\n [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n if [ -n \"${val}\" ]; then\n echo \"Using fallback ${fallback_key} instead of ${key}\"\n fi\n fi\n if [ -z \"${val}\" ]; then\n missing=\"${missing:+${missing}, }${key}\"\n else\n declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n configured=$((configured + 1))\n fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n echo \"Keyless signing is enabled\"\n\n # Save signing config for upload-sbom step\n for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n envvar=\"${SIGNING_KEY_MAP[$key]}\"\n printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n done \u003e/shared/signing-config.env\n\n echo \"Using Rekor URL: ${REKOR_URL}\"\n echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n echo \"[$(date --utc -Ins)] Sign image\"\n echo \"Signing image ${IMAGE_REF} using keyless signing\"\n if ! retry cosign sign -y \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign image\" \u003e\u00262\n exit 1\n fi\nelif [ \"${configured}\" -eq 0 ]; then\n echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "256m", "memory": "512Mi" }, "requests": { "cpu": "256m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "sbom-syft-generate", "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\ncase $SBOM_TYPE in\ncyclonedx)\n syft_sbom_type=cyclonedx-json@1.5\n ;;\nspdx)\n syft_sbom_type=spdx-json@2.3\n ;;\n*)\n echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n exit 1\n ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n oci-dir:\"${OCI_DIR}\"\n --output \"$syft_sbom_type=/var/workdir/sbom-image.json\"\n)\nsyft_source_args=(\n dir:\"/var/workdir/$SOURCE_CODE_DIR/$CONTEXT\"\n --output \"$syft_sbom_type=/var/workdir/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n echo \"Running syft on the source code\"\n syft \"${syft_source_args[@]}\"\nelse\n echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/var/workdir/source" }, { "args": [ "--additional-base-images" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.2.0-1774868067@sha256:2e00c2f0aeff55713150b51822013327ea0e0d75b8164a52f837fb297c17703d", "name": "prepare-sboms", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --additional-base-images)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do\n ADDITIONAL_BASE_IMAGES+=(\"$1\")\n shift\n done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n generate\n --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-image\n --from-syft \"/var/workdir/sbom-image.json\"\n --image-pullspec \"$IMAGE_URL\"\n --image-digest \"$IMAGE_DIGEST\"\n --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/var/workdir/sbom-source.json\" ]; then\n mobster_args+=(--from-syft \"/var/workdir/sbom-source.json\")\nfi\n\nif [ -f \"/var/workdir/sbom-prefetch.json\" ]; then\n mobster_args+=(--from-hermeto \"/var/workdir/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n", "securityContext": { "runAsUser": 0 }, "workingDir": "/var/workdir" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e/tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"; then\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n # shellcheck source=/dev/null\n source /shared/signing-config.env\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"; then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n # spdx export data as rawstring, we want structured json as cyclonedx\n ATT_SBOM_TYPE=\"spdxjson\"\n fi\n\n echo \"[$(date --utc -Ins)] Sign SBOM\"\n echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"; then\n echo \"Failed to sign SBOM\" \u003e\u00262\n exit 1\n fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/var/workdir" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "name": "additional-secret", "secret": { "optional": true, "secretName": "does-not-exist" } }, { "name": "etc-pki-entitlement", "secret": { "optional": true, "secretName": "etc-pki-entitlement" } }, { "name": "oidc-token", "projected": { "sources": [ { "serviceAccountToken": { "audience": "sigstore", "expirationSeconds": 600, "path": "oidc-token" } } ] } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "caching-ca-bundle", "optional": true }, "name": "proxy-ca-bundle" }, { "emptyDir": {}, "name": "shared" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "varlibcontainers" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/sample-multi-component?rev=9a7fd1a74aa41f7d774f43456ce5f82870702729", "build.appstudio.redhat.com/commit_sha": "9a7fd1a74aa41f7d774f43456ce5f82870702729", "build.appstudio.redhat.com/pull_request_number": "34019", "build.appstudio.redhat.com/target_branch": "multi-component-base-iutlzs", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "multi-component-base-iutlzs", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85934985316", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ihhpxi", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-tgve/pipelinerun/go-component-ehwxie-on-pull-request-n65wc", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-base-iutlzs\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-ehwxie-pull-request.yaml\".pathChanged() )", "pipelinesascode.tekton.dev/original-prname": "go-component-ehwxie-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34019", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-e2e-tests[bot]", "pipelinesascode.tekton.dev/sha": "9a7fd1a74aa41f7d774f43456ce5f82870702729", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/sample-multi-component/commit/9a7fd1a74aa41f7d774f43456ce5f82870702729", "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-ehwxie", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-tgve/results/a439a8e2-a8d3-41d0-a5cd-dc36109b3aee/records/ccd5438b-84bd-4af3-bec2-2e973305c3b0", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"sample-multi-component\",\"commit\":\"9a7fd1a74aa41f7d774f43456ce5f82870702729\",\"eventType\":\"pull_request\",\"pull_request-id\":34019}", "results.tekton.dev/result": "build-e2e-tgve/results/a439a8e2-a8d3-41d0-a5cd-dc36109b3aee", "results.tekton.dev/stored": "true", "tekton.dev/categories": "Git", "tekton.dev/displayName": "git clone oci trusted artifacts", "tekton.dev/pipelines.minVersion": "0.21.0", "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64", "tekton.dev/tags": "git", "test.appstudio.openshift.io/pr-group": "konflux-go-component-ehwxie" }, "creationTimestamp": "2026-07-08T17:17:20Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-positive-mc-kgqk", "appstudio.openshift.io/component": "go-component-ehwxie", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85934985316", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "go-component-ehwxie-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34019", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/sha": "9a7fd1a74aa41f7d774f43456ce5f82870702729", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "go-component-ehwxie-on-pull-request-n65wc", "tekton.dev/pipelineRun": "go-component-ehwxie-on-pull-request-n65wc", "tekton.dev/pipelineRunUID": "a439a8e2-a8d3-41d0-a5cd-dc36109b3aee", "tekton.dev/pipelineTask": "clone-repository", "tekton.dev/task": "git-clone-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "d7301c57dbefc6e4efa4787ae625d792dd665fb52c49e23edaa18a278322e0" }, "name": "go-component-ehwxie-on-pull-request-n65wc-clone-repository", "namespace": "build-e2e-tgve", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "go-component-ehwxie-on-pull-request-n65wc", "uid": "a439a8e2-a8d3-41d0-a5cd-dc36109b3aee" } ], "resourceVersion": "27943", "uid": "ccd5438b-84bd-4af3-bec2-2e973305c3b0" }, "spec": { "params": [ { "name": "url", "value": "https://github.com/redhat-appstudio-qe/sample-multi-component" }, { "name": "revision", "value": "9a7fd1a74aa41f7d774f43456ce5f82870702729" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie:on-pr-9a7fd1a74aa41f7d774f43456ce5f82870702729.git" }, { "name": "ociArtifactExpiresAfter", "value": "5d" } ], "serviceAccountName": "build-pipeline-go-component-ehwxie", "taskRef": { "params": [ { "name": "name", "value": "git-clone-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min:0.1@sha256:ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s", "workspaces": [ { "name": "basic-auth", "secret": { "secretName": "pac-gitauth-ihhpxi" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-07-08T17:17:28Z", "conditions": [ { "lastTransitionTime": "2026-07-08T17:17:28Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "go-component-ehwxie-on-pull-request-n65wc-clone-repository-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "ad1487d03967da7e9e032ba47b094ebf7e46c8e6f5d47faa9f8c15e1617fb208" }, "entryPoint": "git-clone-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta-min" } }, "results": [ { "name": "CHAINS-GIT_COMMIT", "type": "string", "value": "9a7fd1a74aa41f7d774f43456ce5f82870702729" }, { "name": "CHAINS-GIT_URL", "type": "string", "value": "https://github.com/redhat-appstudio-qe/sample-multi-component" }, { "name": "commit", "type": "string", "value": "9a7fd1a74aa41f7d774f43456ce5f82870702729" }, { "name": "commit-timestamp", "type": "string", "value": "1783531022" }, { "name": "short-commit", "type": "string", "value": "9a7fd1a" }, { "name": "url", "type": "string", "value": "https://github.com/redhat-appstudio-qe/sample-multi-component" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie@sha256:1582046614f5fead2028d48d1ab33b378d67bec6c2f1549cf804c7b7f0f64c73" } ], "startTime": "2026-07-08T17:17:20Z", "steps": [ { "container": "step-clone", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "provenance": {}, "terminated": { "containerID": "containerd://30d5887100d6e3b8819149b9cff96b164fc187ecf2737b1ede4224cf1b9877ca", "exitCode": 0, "finishedAt": "2026-07-08T17:17:25Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"9a7fd1a74aa41f7d774f43456ce5f82870702729\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/sample-multi-component\",\"type\":1},{\"key\":\"commit\",\"value\":\"9a7fd1a74aa41f7d774f43456ce5f82870702729\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1783531022\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"9a7fd1a\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/sample-multi-component\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:17:25Z" }, "terminationReason": "Completed" }, { "container": "step-symlink-check", "imageID": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "provenance": {}, "terminated": { "containerID": "containerd://b8274b626fc89a75b4ff2ce858cc44637c3a028c8883c531f1148d8a8a42e861", "exitCode": 0, "finishedAt": "2026-07-08T17:17:26Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"9a7fd1a74aa41f7d774f43456ce5f82870702729\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/sample-multi-component\",\"type\":1},{\"key\":\"commit\",\"value\":\"9a7fd1a74aa41f7d774f43456ce5f82870702729\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1783531022\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"9a7fd1a\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/sample-multi-component\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:17:26Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://f79035e107a77de8187b9e1aa7b11e5e122b8a608b52ad1778addd50fa78aeae", "exitCode": 0, "finishedAt": "2026-07-08T17:17:28Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"9a7fd1a74aa41f7d774f43456ce5f82870702729\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/redhat-appstudio-qe/sample-multi-component\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie@sha256:1582046614f5fead2028d48d1ab33b378d67bec6c2f1549cf804c7b7f0f64c73\",\"type\":1},{\"key\":\"commit\",\"value\":\"9a7fd1a74aa41f7d774f43456ce5f82870702729\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1783531022\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"9a7fd1a\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/redhat-appstudio-qe/sample-multi-component\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:17:26Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The git-clone-oci-ta Task will clone a repo from the provided url and store it as a trusted artifact in the provided OCI repository.", "params": [ { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "1", "description": "Perform a shallow clone, fetching only the most recent N commits.", "name": "depth", "type": "string" }, { "default": "true", "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n", "name": "enableSymlinkCheck", "type": "string" }, { "default": "false", "description": "Fetch all tags for the repo.", "name": "fetchTags", "type": "string" }, { "default": "", "description": "HTTP proxy server for non-SSL requests.", "name": "httpProxy", "type": "string" }, { "default": "", "description": "HTTPS proxy server for SSL requests.", "name": "httpsProxy", "type": "string" }, { "default": "", "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n", "name": "mergeSourceDepth", "type": "string" }, { "default": "", "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n", "name": "mergeSourceRepoUrl", "type": "string" }, { "default": "false", "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.", "name": "mergeTargetBranch", "type": "string" }, { "default": "", "description": "Opt out of proxying HTTP/HTTPS requests.", "name": "noProxy", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "", "description": "Refspec to fetch before checking out revision.", "name": "refspec", "type": "string" }, { "default": "", "description": "Revision to checkout. (branch, tag, sha, ref, etc...)", "name": "revision", "type": "string" }, { "default": "7", "description": "Length of short commit SHA", "name": "shortCommitLength", "type": "string" }, { "default": "", "description": "Define the directory patterns to match or exclude when performing a sparse checkout.", "name": "sparseCheckoutDirectories", "type": "string" }, { "default": "true", "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.", "name": "sslVerify", "type": "string" }, { "default": "", "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched.\nEmpty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.\n", "name": "submodulePaths", "type": "string" }, { "default": "true", "description": "Initialize and fetch git submodules.", "name": "submodules", "type": "string" }, { "default": "main", "description": "The target branch to merge into the revision (if mergeTargetBranch is true).", "name": "targetBranch", "type": "string" }, { "description": "Repository URL to clone from.", "name": "url", "type": "string" }, { "default": "/tekton/home", "description": "Absolute path to the user's home directory. Set this explicitly if you are running the image as a non-root user.\n", "name": "userHome", "type": "string" }, { "default": "false", "description": "Log the commands that are executed during `git-clone`'s operation.", "name": "verbose", "type": "string" } ], "results": [ { "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_COMMIT", "type": "string" }, { "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_URL", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "description": "The precise commit SHA that was fetched by this Task.", "name": "commit", "type": "string" }, { "description": "The commit timestamp of the checkout", "name": "commit-timestamp", "type": "string" }, { "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).", "name": "merged_sha", "type": "string" }, { "description": "The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters", "name": "short-commit", "type": "string" }, { "description": "The precise URL that was fetched by this Task.", "name": "url", "type": "string" } ], "steps": [ { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "PARAM_URL", "value": "https://github.com/redhat-appstudio-qe/sample-multi-component" }, { "name": "PARAM_REVISION", "value": "9a7fd1a74aa41f7d774f43456ce5f82870702729" }, { "name": "PARAM_REFSPEC" }, { "name": "PARAM_SUBMODULES", "value": "true" }, { "name": "PARAM_SUBMODULE_PATHS" }, { "name": "PARAM_DEPTH", "value": "1" }, { "name": "PARAM_SHORT_COMMIT_LENGTH", "value": "7" }, { "name": "PARAM_SSL_VERIFY", "value": "true" }, { "name": "PARAM_HTTP_PROXY" }, { "name": "PARAM_HTTPS_PROXY" }, { "name": "PARAM_NO_PROXY" }, { "name": "PARAM_VERBOSE", "value": "false" }, { "name": "PARAM_SPARSE_CHECKOUT_DIRECTORIES" }, { "name": "PARAM_USER_HOME", "value": "/tekton/home" }, { "name": "PARAM_FETCH_TAGS", "value": "false" }, { "name": "PARAM_MERGE_TARGET_BRANCH", "value": "false" }, { "name": "PARAM_TARGET_BRANCH", "value": "main" }, { "name": "PARAM_MERGE_SOURCE_REPO_URL" }, { "name": "PARAM_MERGE_SOURCE_DEPTH" }, { "name": "WORKSPACE_SSH_DIRECTORY_BOUND", "value": "false" }, { "name": "WORKSPACE_SSH_DIRECTORY_PATH" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND", "value": "true" }, { "name": "WORKSPACE_BASIC_AUTH_DIRECTORY_PATH", "value": "/workspace/basic-auth" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "clone", "script": "#!/usr/bin/env sh\nset -eu\n\nif [ \"${PARAM_VERBOSE}\" = \"true\" ]; then\n set -x\nfi\n\nif [ \"${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}\" = \"true\" ]; then\n if [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" ]; then\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials\" \"${PARAM_USER_HOME}/.git-credentials\"\n cp \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig\" \"${PARAM_USER_HOME}/.gitconfig\"\n # Compatibility with kubernetes.io/basic-auth secrets\n elif [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username\" ] \u0026\u0026 [ -f \"${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password\" ]; then\n HOSTNAME=$(echo $PARAM_URL | awk -F/ '{print $3}')\n echo \"https://$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/username):$(cat ${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/password)@$HOSTNAME\" \u003e\"${PARAM_USER_HOME}/.git-credentials\"\n echo -e \"[credential \\\"https://$HOSTNAME\\\"]\\n helper = store\" \u003e\"${PARAM_USER_HOME}/.gitconfig\"\n else\n echo \"Unknown basic-auth workspace format\"\n exit 1\n fi\n chmod 400 \"${PARAM_USER_HOME}/.git-credentials\"\n chmod 400 \"${PARAM_USER_HOME}/.gitconfig\"\nfi\n\n# Should be called after the gitconfig is copied from the repository secret\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n git config --global http.sslCAInfo \"$ca_bundle\"\nfi\n\nif [ \"${WORKSPACE_SSH_DIRECTORY_BOUND}\" = \"true\" ]; then\n cp -R \"${WORKSPACE_SSH_DIRECTORY_PATH}\" \"${PARAM_USER_HOME}\"/.ssh\n chmod 700 \"${PARAM_USER_HOME}\"/.ssh\n chmod -R 400 \"${PARAM_USER_HOME}\"/.ssh/*\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\n/ko-app/git-init \\\n -url=\"${PARAM_URL}\" \\\n -revision=\"${PARAM_REVISION}\" \\\n -refspec=\"${PARAM_REFSPEC}\" \\\n -path=\"${CHECKOUT_DIR}\" \\\n -sslVerify=\"${PARAM_SSL_VERIFY}\" \\\n -submodules=\"${PARAM_SUBMODULES}\" \\\n -submodulePaths=\"${PARAM_SUBMODULE_PATHS}\" \\\n -depth=\"${PARAM_DEPTH}\" \\\n -sparseCheckoutDirectories=\"${PARAM_SPARSE_CHECKOUT_DIRECTORIES}\" \\\n -retryMaxAttempts=10\ncd \"${CHECKOUT_DIR}\"\nRESULT_SHA=\"$(git rev-parse HEAD)\"\nRESULT_SHA_SHORT=\"$(git rev-parse --short=\"${PARAM_SHORT_COMMIT_LENGTH}\" HEAD)\"\n\nif [ \"${PARAM_MERGE_TARGET_BRANCH}\" = \"true\" ]; then\n echo \"Merge option enabled. Attempting to merge target branch '${PARAM_TARGET_BRANCH}' into HEAD (${RESULT_SHA}).\"\n\n if [ \"${PARAM_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow clone with depth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n if [ \"${PARAM_MERGE_SOURCE_DEPTH}\" = \"1\" ]; then\n echo \"WARNING: Shallow fetch with mergeSourceDepth=1 may cause merge conflicts due to insufficient commit history.\" \u003e\u00262\n fi\n\n # Determine if merging from a different repository or the same one\n if [ -n \"${PARAM_MERGE_SOURCE_REPO_URL}\" ]; then\n # Normalize URLs for comparison (remove trailing slashes and .git suffix)\n normalize_url() {\n echo \"$1\" | sed -e 's#/$##' -e 's#\\.git$##'\n }\n\n NORMALIZED_ORIGIN_URL=$(normalize_url \"${PARAM_URL}\")\n NORMALIZED_MERGE_URL=$(normalize_url \"${PARAM_MERGE_SOURCE_REPO_URL}\")\n\n if [ \"${NORMALIZED_ORIGIN_URL}\" = \"${NORMALIZED_MERGE_URL}\" ]; then\n echo \"Merge source URL is the same as origin. Using existing 'origin' remote.\"\n MERGE_REMOTE=\"origin\"\n else\n echo \"Merging from different repository: ${PARAM_MERGE_SOURCE_REPO_URL}\"\n echo \"Adding remote 'merge-source'...\"\n git remote add merge-source \"${PARAM_MERGE_SOURCE_REPO_URL}\"\n MERGE_REMOTE=\"merge-source\"\n fi\n else\n echo \"Merging from the same repository (origin)\"\n MERGE_REMOTE=\"origin\"\n fi\n\n echo \"Fetching target branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE}...\"\n if [ -n \"${PARAM_MERGE_SOURCE_DEPTH}\" ]; then\n retry git fetch --depth=\"${PARAM_MERGE_SOURCE_DEPTH}\" ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n else\n retry git fetch ${MERGE_REMOTE} \"${PARAM_TARGET_BRANCH}\"\n fi\n\n echo \"Merging ${MERGE_REMOTE}/${PARAM_TARGET_BRANCH} into current HEAD...\"\n git config --global user.email \"tekton-git-clone@tekton.dev\"\n git config --global user.name \"Tekton Git Clone Task\"\n\n if ! git merge FETCH_HEAD --no-commit --no-ff --allow-unrelated-histories; then\n echo \"ERROR: Merge conflict detected or merge failed before commit.\" \u003e\u00262\n echo \"--- Git Status ---\"\n git status\n echo \"------------------\"\n exit 1\n fi\n\n # Check if there are changes staged for commit\n if git diff --staged --quiet; then\n echo \"No diff was found, skipping merge...\" \u003e\u00262\n else\n echo \"Merge successful (no conflicts found), committing...\"\n if ! git commit -m \"Merge branch '${PARAM_TARGET_BRANCH}' from ${MERGE_REMOTE} into ${RESULT_SHA}\"; then\n echo \"ERROR: Failed to commit merge.\" \u003e\u00262\n exit 1\n fi\n MERGED_SHA=$(git rev-parse HEAD)\n echo \"New HEAD after merge: ${MERGED_SHA}\"\n echo \"${MERGED_SHA}\" \u003e\"/tekton/results/merged_sha\"\n fi\n\nelse\n echo \"Merge option disabled. Using checked-out revision ${RESULT_SHA} directly.\"\nfi\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/commit\"\nprintf \"%s\" \"${RESULT_SHA}\" \u003e\"/tekton/results/CHAINS-GIT_COMMIT\"\nprintf \"%s\" \"${RESULT_SHA_SHORT}\" \u003e\"/tekton/results/short-commit\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/url\"\nprintf \"%s\" \"${PARAM_URL}\" \u003e\"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(git log -1 --pretty=%ct)\" \u003e\"/tekton/results/commit-timestamp\"\n\nif [ \"${PARAM_FETCH_TAGS}\" = \"true\" ]; then\n echo \"Fetching tags\"\n retry git fetch --tags\nfi\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "computeResources": {}, "env": [ { "name": "PARAM_ENABLE_SYMLINK_CHECK", "value": "true" }, { "name": "CHECKOUT_DIR", "value": "/var/workdir/source" } ], "image": "quay.io/konflux-ci/git-clone@sha256:09ac9c14392b5c2b8057f66cc4abfb8ce5d7214706318959d00908923a754434", "name": "symlink-check", "script": "#!/usr/bin/env bash\nset -euo pipefail\n\ncheck_symlinks() {\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false\n while read -r symlink; do\n target=$(readlink -m \"$symlink\")\n if ! [[ \"$target\" =~ ^$CHECKOUT_DIR ]]; then\n echo \"The cloned repository contains symlink pointing outside of the cloned repository: $symlink\"\n FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true\n fi\n done \u003c \u003c(find $CHECKOUT_DIR -type l -print)\n if [ \"$FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO\" = true ]; then\n return 1\n fi\n}\n\nif [ \"${PARAM_ENABLE_SYMLINK_CHECK}\" = \"true\" ]; then\n echo \"Running symlink check\"\n check_symlinks\nfi\n", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie:on-pr-9a7fd1a74aa41f7d774f43456ce5f82870702729.git", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "5d" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n", "name": "basic-auth", "optional": true }, { "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n", "name": "ssh-directory", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/sample-multi-component?rev=9a7fd1a74aa41f7d774f43456ce5f82870702729", "build.appstudio.redhat.com/commit_sha": "9a7fd1a74aa41f7d774f43456ce5f82870702729", "build.appstudio.redhat.com/pull_request_number": "34019", "build.appstudio.redhat.com/target_branch": "multi-component-base-iutlzs", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "multi-component-base-iutlzs", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85934985316", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ihhpxi", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-tgve/pipelinerun/go-component-ehwxie-on-pull-request-n65wc", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-base-iutlzs\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-ehwxie-pull-request.yaml\".pathChanged() )", "pipelinesascode.tekton.dev/original-prname": "go-component-ehwxie-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34019", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-e2e-tests[bot]", "pipelinesascode.tekton.dev/sha": "9a7fd1a74aa41f7d774f43456ce5f82870702729", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/sample-multi-component/commit/9a7fd1a74aa41f7d774f43456ce5f82870702729", "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-ehwxie", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-tgve/results/a439a8e2-a8d3-41d0-a5cd-dc36109b3aee/records/3fcdc5e1-2772-4397-b51d-4ce42acd5386", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"sample-multi-component\",\"commit\":\"9a7fd1a74aa41f7d774f43456ce5f82870702729\",\"eventType\":\"pull_request\",\"pull_request-id\":34019}", "results.tekton.dev/result": "build-e2e-tgve/results/a439a8e2-a8d3-41d0-a5cd-dc36109b3aee", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "test.appstudio.openshift.io/pr-group": "konflux-go-component-ehwxie" }, "creationTimestamp": "2026-07-08T17:17:16Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-positive-mc-kgqk", "appstudio.openshift.io/component": "go-component-ehwxie", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85934985316", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "go-component-ehwxie-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34019", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/sha": "9a7fd1a74aa41f7d774f43456ce5f82870702729", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "go-component-ehwxie-on-pull-request-n65wc", "tekton.dev/pipelineRun": "go-component-ehwxie-on-pull-request-n65wc", "tekton.dev/pipelineRunUID": "a439a8e2-a8d3-41d0-a5cd-dc36109b3aee", "tekton.dev/pipelineTask": "init", "tekton.dev/task": "init", "test.appstudio.openshift.io/pr-group-sha": "d7301c57dbefc6e4efa4787ae625d792dd665fb52c49e23edaa18a278322e0" }, "name": "go-component-ehwxie-on-pull-request-n65wc-init", "namespace": "build-e2e-tgve", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "go-component-ehwxie-on-pull-request-n65wc", "uid": "a439a8e2-a8d3-41d0-a5cd-dc36109b3aee" } ], "resourceVersion": "27751", "uid": "3fcdc5e1-2772-4397-b51d-4ce42acd5386" }, "spec": { "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "serviceAccountName": "build-pipeline-go-component-ehwxie", "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-08T17:17:19Z", "conditions": [ { "lastTransitionTime": "2026-07-08T17:17:19Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "go-component-ehwxie-on-pull-request-n65wc-init-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08" }, "entryPoint": "init", "uri": "quay.io/konflux-ci/tekton-catalog/task-init" } }, "results": [ { "name": "http-proxy", "type": "string", "value": "" }, { "name": "no-proxy", "type": "string", "value": "" } ], "startTime": "2026-07-08T17:17:16Z", "steps": [ { "container": "step-init", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init", "provenance": {}, "terminated": { "containerID": "containerd://03f4297de547bfd4eaafd0922613ce8a112155b9240d4878c46bad7705564df4", "exitCode": 0, "finishedAt": "2026-07-08T17:17:19Z", "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:17:19Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.", "params": [ { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" } ], "results": [ { "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)", "name": "http-proxy", "type": "string" }, { "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)", "name": "no-proxy", "type": "string" } ], "steps": [ { "args": [ "--enable", "false" ], "command": [ "konflux-build-cli", "config", "cache-proxy" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "DEFAULT_HTTP_PROXY", "value": "squid.caching.svc.cluster.local:3128" }, { "name": "DEFAULT_NO_PROXY", "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai" }, { "name": "HTTP_PROXY_RESULTS_PATH", "value": "/tekton/results/http-proxy" }, { "name": "NO_PROXY_RESULTS_PATH", "value": "/tekton/results/no-proxy" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://github.com/redhat-appstudio-qe/sample-multi-component?rev=9a7fd1a74aa41f7d774f43456ce5f82870702729", "build.appstudio.redhat.com/commit_sha": "9a7fd1a74aa41f7d774f43456ce5f82870702729", "build.appstudio.redhat.com/pull_request_number": "34019", "build.appstudio.redhat.com/target_branch": "multi-component-base-iutlzs", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "multi-component-base-iutlzs", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85934985316", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ihhpxi", "pipelinesascode.tekton.dev/git-provider": "github", "pipelinesascode.tekton.dev/installation-id": "72200095", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-tgve/pipelinerun/go-component-ehwxie-on-pull-request-n65wc", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"pull_request\" \u0026\u0026 target_branch == \"multi-component-base-iutlzs\" \u0026\u0026 ( \"go-component/***\".pathChanged() || \".tekton/go-component-ehwxie-pull-request.yaml\".pathChanged() )", "pipelinesascode.tekton.dev/original-prname": "go-component-ehwxie-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34019", "pipelinesascode.tekton.dev/repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-e2e-tests[bot]", "pipelinesascode.tekton.dev/sha": "9a7fd1a74aa41f7d774f43456ce5f82870702729", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://github.com/redhat-appstudio-qe/sample-multi-component/commit/9a7fd1a74aa41f7d774f43456ce5f82870702729", "pipelinesascode.tekton.dev/source-branch": "konflux-go-component-ehwxie", "pipelinesascode.tekton.dev/source-repo-url": "https://github.com/redhat-appstudio-qe/sample-multi-component", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-tgve/results/a439a8e2-a8d3-41d0-a5cd-dc36109b3aee/records/fe33a2c1-f890-4b53-a5e8-a1c02525de7d", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"sample-multi-component\",\"commit\":\"9a7fd1a74aa41f7d774f43456ce5f82870702729\",\"eventType\":\"pull_request\",\"pull_request-id\":34019}", "results.tekton.dev/result": "build-e2e-tgve/results/a439a8e2-a8d3-41d0-a5cd-dc36109b3aee", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "test.appstudio.openshift.io/pr-group": "konflux-go-component-ehwxie" }, "creationTimestamp": "2026-07-08T17:17:29Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-positive-mc-kgqk", "appstudio.openshift.io/component": "go-component-ehwxie", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "true", "pipelinesascode.tekton.dev/check-run-id": "85934985316", "pipelinesascode.tekton.dev/event-type": "pull_request", "pipelinesascode.tekton.dev/original-prname": "go-component-ehwxie-on-pull-request", "pipelinesascode.tekton.dev/pull-request": "34019", "pipelinesascode.tekton.dev/repository": "github-com-redhat-appstudio-qe-sample-multi-component", "pipelinesascode.tekton.dev/sha": "9a7fd1a74aa41f7d774f43456ce5f82870702729", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "redhat-appstudio-qe", "pipelinesascode.tekton.dev/url-repository": "sample-multi-component", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "go-component-ehwxie-on-pull-request-n65wc", "tekton.dev/pipelineRun": "go-component-ehwxie-on-pull-request-n65wc", "tekton.dev/pipelineRunUID": "a439a8e2-a8d3-41d0-a5cd-dc36109b3aee", "tekton.dev/pipelineTask": "prefetch-dependencies", "tekton.dev/task": "prefetch-dependencies-oci-ta-min", "test.appstudio.openshift.io/pr-group-sha": "d7301c57dbefc6e4efa4787ae625d792dd665fb52c49e23edaa18a278322e0" }, "name": "go-component-ehwxie-on-pull-request-n65wc-prefetch-dependencies", "namespace": "build-e2e-tgve", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "go-component-ehwxie-on-pull-request-n65wc", "uid": "a439a8e2-a8d3-41d0-a5cd-dc36109b3aee" } ], "resourceVersion": "28681", "uid": "fe33a2c1-f890-4b53-a5e8-a1c02525de7d" }, "spec": { "params": [ { "name": "input", "value": "" }, { "name": "enable-package-registry-proxy", "value": "true" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie@sha256:1582046614f5fead2028d48d1ab33b378d67bec6c2f1549cf804c7b7f0f64c73" }, { "name": "ociStorage", "value": "quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie:on-pr-9a7fd1a74aa41f7d774f43456ce5f82870702729.prefetch" }, { "name": "ociArtifactExpiresAfter", "value": "5d" } ], "serviceAccountName": "build-pipeline-go-component-ehwxie", "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies-oci-ta-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min:0.3@sha256:af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s", "workspaces": [ { "name": "git-basic-auth", "secret": { "secretName": "pac-gitauth-ihhpxi" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-07-08T17:18:17Z", "conditions": [ { "lastTransitionTime": "2026-07-08T17:18:17Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "go-component-ehwxie-on-pull3cf73edfe1c5655cffde66aed6cdd8f9-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "af12fee3a119b4099d18e19f81cd963a4077dc941da9e28ba82e43f656a65929" }, "entryPoint": "prefetch-dependencies-oci-ta-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta-min" } }, "results": [ { "name": "CACHI2_ARTIFACT", "type": "string", "value": "" }, { "name": "SOURCE_ARTIFACT", "type": "string", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie@sha256:1582046614f5fead2028d48d1ab33b378d67bec6c2f1549cf804c7b7f0f64c73" } ], "startTime": "2026-07-08T17:17:29Z", "steps": [ { "container": "step-skip-ta", "imageID": "registry.access.redhat.com/ubi9/ubi-minimal@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "provenance": {}, "terminated": { "containerID": "containerd://4e7445e40f97fe766431302aff45da41b09bbef48785f24fc37df38bdd74067a", "exitCode": 0, "finishedAt": "2026-07-08T17:17:36Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie@sha256:1582046614f5fead2028d48d1ab33b378d67bec6c2f1549cf804c7b7f0f64c73\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:17:36Z" }, "terminationReason": "Completed" }, { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://1e6cf2927ed057b9c5c454b3014bcc62d67afde82922cd3bbdf3f9b755d01a58", "exitCode": 0, "finishedAt": "2026-07-08T17:17:36Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie@sha256:1582046614f5fead2028d48d1ab33b378d67bec6c2f1549cf804c7b7f0f64c73\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:17:36Z" }, "terminationReason": "Completed" }, { "container": "step-prefetch-dependencies", "imageID": "quay.io/konflux-ci/hermeto@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "provenance": {}, "terminated": { "containerID": "containerd://b9d0fa608907cb82341c17c6d2854008120256b4ac3fe8b64cf1a2a5446c812b", "exitCode": 0, "finishedAt": "2026-07-08T17:18:16Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie@sha256:1582046614f5fead2028d48d1ab33b378d67bec6c2f1549cf804c7b7f0f64c73\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:17:37Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://9878c0260c10738fbd8b5c12c891445cb15add4e8f51efbc11281c8e6726bff3", "exitCode": 0, "finishedAt": "2026-07-08T17:18:16Z", "message": "[{\"key\":\"CACHI2_ARTIFACT\",\"value\":\"\",\"type\":1},{\"key\":\"SOURCE_ARTIFACT\",\"value\":\"oci:quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie@sha256:1582046614f5fead2028d48d1ab33b378d67bec6c2f1549cf804c7b7f0f64c73\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:18:16Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Task that prefetches project dependencies for hermetic build.", "params": [ { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": "service-ca.crt", "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "openshift-service-ca.crt", "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "", "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n", "name": "config-file-content", "type": "string" }, { "default": "true", "description": "Use the package registry proxy when prefetching dependencies", "name": "enable-package-registry-proxy", "type": "string" }, { "description": "Configures project packages that will have their dependencies prefetched.", "name": "input", "type": "string" }, { "default": "debug", "description": "Set the logging level (debug, info, warn, error, fatal).", "name": "log-level", "type": "string" }, { "default": "strict", "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).", "name": "mode", "type": "string" }, { "default": "", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire.", "name": "ociArtifactExpiresAfter", "type": "string" }, { "description": "The OCI repository where the Trusted Artifacts are stored.", "name": "ociStorage", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.", "name": "sbom-type", "type": "string" } ], "results": [ { "description": "The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.", "name": "CACHI2_ARTIFACT", "type": "string" }, { "description": "The Trusted Artifact URI pointing to the artifact with the application source code.", "name": "SOURCE_ARTIFACT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" } ] }, "steps": [ { "computeResources": {}, "env": [ { "name": "INPUT" }, { "name": "SOURCE_ARTIFACT", "value": "oci:quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie@sha256:1582046614f5fead2028d48d1ab33b378d67bec6c2f1549cf804c7b7f0f64c73" } ], "image": "registry.access.redhat.com/ubi9/ubi-minimal:9.7-1777857961@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23", "name": "skip-ta", "script": "#!/bin/bash\n\nif [ -z \"${INPUT}\" ]; then\n mkdir -p /var/workdir/source\n mkdir -p /var/workdir/cachi2\n echo \"true\" \u003e/var/workdir/source/.skip-trusted-artifacts\n echo \"true\" \u003e/var/workdir/cachi2/.skip-trusted-artifacts\n echo -n \"${SOURCE_ARTIFACT}\" \u003e\"/tekton/results/SOURCE_ARTIFACT\"\n echo -n \"\" \u003e\"/tekton/results/CACHI2_ARTIFACT\"\nfi\n" }, { "args": [ "use", "oci:quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie@sha256:1582046614f5fead2028d48d1ab33b378d67bec6c2f1549cf804c7b7f0f64c73=/var/workdir/source" ], "computeResources": {}, "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "debug" }, { "name": "KBC_PD_INPUT" }, { "name": "KBC_PD_SOURCE_DIR", "value": "/var/workdir/source" }, { "name": "KBC_PD_OUTPUT_DIR", "value": "/var/workdir/cachi2/output" }, { "name": "KBC_PD_SBOM_FORMAT", "value": "spdx" }, { "name": "KBC_PD_MODE", "value": "strict" }, { "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT", "value": "/cachi2/output" }, { "name": "KBC_PD_ENV_FILES", "value": "/var/workdir/cachi2/cachi2.env /var/workdir/cachi2/prefetch.env /var/workdir/cachi2/prefetch-env.json" }, { "name": "KBC_PD_GIT_AUTH_DIRECTORY", "value": "/workspace/git-basic-auth" }, { "name": "WORKSPACE_NETRC_PATH" }, { "name": "CONFIG_FILE_CONTENT" }, { "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY", "value": "true" } ], "image": "quay.io/konflux-ci/hermeto:0.51.0@sha256:4899755ffd1574547102a58469aea916822c7fd7825cbec8e477e1b57668a6d7", "name": "prefetch-dependencies", "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n update-ca-trust\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n export KBC_PD_RHSM_ORG=/activation-key/org\n export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n echo \"${CONFIG_FILE_CONTENT}\" \u003e/mnt/config/config.yaml\n export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nkonflux-build-cli prefetch-dependencies\n", "volumeMounts": [ { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/mnt/config", "name": "config" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/service-ca", "name": "service-ca", "readOnly": true } ] }, { "args": [ "create", "--store", "quay.io/redhat-appstudio-qe/build-e2e-tgve/go-component-ehwxie:on-pr-9a7fd1a74aa41f7d774f43456ce5f82870702729.prefetch", "/tekton/results/SOURCE_ARTIFACT=/var/workdir/source", "/tekton/results/CACHI2_ARTIFACT=/var/workdir/cachi2" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "5d" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:339f1a641a46e2a20b5c1aa5d1323c702812d012a1fae475ab27ae795554e523", "name": "create-trusted-artifact" } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "emptyDir": {}, "name": "config" }, { "configMap": { "items": [ { "key": "service-ca.crt", "path": "ca-bundle.crt" } ], "name": "openshift-service-ca.crt", "optional": true }, "name": "service-ca" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ], "workspaces": [ { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n", "name": "git-basic-auth", "optional": true }, { "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n", "name": "netrc", "optional": true } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }