{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.redhat.com/nudged-components": "gl-multi-component-child-xgkn", "build.appstudio.redhat.com/nudging-commit": "668e3ca8e9c04d1e0e746f0e5843fd89b5128714", "build.appstudio.redhat.com/nudging-component": "gl-multi-component-parent-xgkn", "build.appstudio.redhat.com/nudging-image": "quay.io/redhat-appstudio-qe/build-e2e-psut/gl-multi-component-parent-xgkn:668e3ca8e9c04d1e0e746f0e5843fd89b5128714", "build.appstudio.redhat.com/nudging-pipeline": "gl-multi-component-parent-xgkn-on-push-h8d4c", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-psut/results/9797374b-78f9-4a30-baef-b04b98041b73/records/9e3ba4e5-8391-4ff2-a949-79c13f091a8a", "results.tekton.dev/result": "build-e2e-psut/results/9797374b-78f9-4a30-baef-b04b98041b73", "results.tekton.dev/stored": "true" }, "creationTimestamp": "2026-05-12T11:30:00Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "build.appstudio.redhat.com/type": "nudge", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-pipeline-1778585400-e497b", "tekton.dev/pipelineRun": "renovate-pipeline-1778585400-e497b", "tekton.dev/pipelineRunUID": "9797374b-78f9-4a30-baef-b04b98041b73", "tekton.dev/pipelineTask": "renovate" }, "name": "renovate-pipeline-1778585400-e497b-renovate", "namespace": "build-e2e-psut", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-pipeline-1778585400-e497b", "uid": "9797374b-78f9-4a30-baef-b04b98041b73" } ], "resourceVersion": "25777", "uid": "9e3ba4e5-8391-4ff2-a949-79c13f091a8a" }, "spec": { "serviceAccountName": "build-pipeline-gl-multi-component-parent-xgkn", "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_00c8d1a019 RENOVATE_CONFIG_FILE=/configs/gl-multi-component-child-xgkn-28916.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_psut_gl_multi_component_parent_xgkn_d6b3dba4ae','password':'${TOKEN_a566ddd042}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1778585400-e497b" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1778585400-e497b" } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1778585400-e497b" }, "name": "renovate-pipeline-1778585400-e497b" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-12T11:32:26Z", "conditions": [ { "lastTransitionTime": "2026-05-12T11:32:26Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "renovate-pipeline-1778585400-e497b-renovate-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-05-12T11:30:00Z", "steps": [ { "container": "step-renovate", "imageID": "quay.io/konflux-ci/mintmaker-renovate-image@sha256:67d26b20533790565a2949a3f732d595dda9378fea506f1cba88ca17cef13873", "name": "renovate", "provenance": {}, "terminated": { "containerID": "containerd://6b61e59abd3373666d78859b0e368cb19e241603956854d60614df7744ddfa58", "exitCode": 0, "finishedAt": "2026-05-12T11:32:25Z", "reason": "Completed", "startedAt": "2026-05-12T11:32:14Z" }, "terminationReason": "Completed" } ], "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_00c8d1a019 RENOVATE_CONFIG_FILE=/configs/gl-multi-component-child-xgkn-28916.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_psut_gl_multi_component_parent_xgkn_d6b3dba4ae','password':'${TOKEN_a566ddd042}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1778585400-e497b" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1778585400-e497b" } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1778585400-e497b" }, "name": "renovate-pipeline-1778585400-e497b" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ezwfnw/-/tree/219b80c26cab889ef11052f7ffaa2bd3be8df61e", "build.appstudio.redhat.com/commit_sha": "219b80c26cab889ef11052f7ffaa2bd3be8df61e", "build.appstudio.redhat.com/target_branch": "base-atzqqx", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-atzqqx", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uefukb", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/log-url": "https://35.155.109.137:9443/ns/build-e2e-yoqc/pipelinerun/gl-test-custom-branch-qtsekv-on-push-5v5pq", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-atzqqx\"", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-qtsekv-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ezwfnw", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ezwfnw", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "219b80c26cab889ef11052f7ffaa2bd3be8df61e", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ezwfnw/-/commit/219b80c26cab889ef11052f7ffaa2bd3be8df61e", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-atzqqx", "pipelinesascode.tekton.dev/source-project-id": "82123586", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ezwfnw", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/target-project-id": "82123586", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ezwfnw", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-yoqc/results/936ada68-174e-4cd3-8b13-bbd6261fbe88/records/1aa6d554-bc45-4fde-b8a3-b679a6d39ce3", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-ezwfnw\",\"commit\":\"219b80c26cab889ef11052f7ffaa2bd3be8df61e\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-yoqc/results/936ada68-174e-4cd3-8b13-bbd6261fbe88", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux" }, "creationTimestamp": "2026-05-12T11:37:28Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-05-12T11:38:11Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-guwv", "appstudio.openshift.io/component": "gl-test-custom-branch-qtsekv", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-qtsekv-on-push", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ezwfnw", "pipelinesascode.tekton.dev/sha": "219b80c26cab889ef11052f7ffaa2bd3be8df61e", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ezwfnw", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-test-custom-branch-qtsekv-on-push-5v5pq", "tekton.dev/pipelineRun": "gl-test-custom-branch-qtsekv-on-push-5v5pq", "tekton.dev/pipelineRunUID": "936ada68-174e-4cd3-8b13-bbd6261fbe88", "tekton.dev/pipelineTask": "clair-scan", "tekton.dev/task": "clair-scan" }, "name": "gl-test-custom-branch-qtsekv-on-push-5v5pq-clair-scan", "namespace": "build-e2e-yoqc", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-test-custom-branch-qtsekv-on-push-5v5pq", "uid": "936ada68-174e-4cd3-8b13-bbd6261fbe88" } ], "resourceVersion": "30028", "uid": "1aa6d554-bc45-4fde-b8a3-b679a6d39ce3" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e" } ], "serviceAccountName": "build-pipeline-gl-test-custom-branch-qtsekv", "taskRef": { "params": [ { "name": "name", "value": "clair-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-12T11:38:05Z", "conditions": [ { "lastTransitionTime": "2026-05-12T11:38:05Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-test-custom-branch-qtsekv-on-push-5v5pq-clair-scan-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "9397d3eb9f1cbebaa15e93256e0ca9eaca148baa674be72f07f4a00df63c4609" }, "entryPoint": "clair-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-clair-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e\", \"digests\": [\"sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b\"]}}\n" }, { "name": "REPORTS", "type": "string", "value": "{\"sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b\":\"sha256:8da5b53653cd6b28e369a809df2fb408498a786876da3a5308701a98e29ef483\"}\n" }, { "name": "SCAN_OUTPUT", "type": "string", "value": "{\"vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0},\"unpatched_vulnerabilities\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"unknown\":0}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"SUCCESS\",\"timestamp\":\"2026-05-12T11:38:04+00:00\",\"note\":\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\",\"namespace\":\"default\",\"successes\":0,\"failures\":0,\"warnings\":0}\n" } ], "startTime": "2026-05-12T11:37:28Z", "steps": [ { "container": "step-get-image-manifests", "imageID": "quay.io/konflux-ci/konflux-test@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d", "name": "get-image-manifests", "provenance": {}, "terminated": { "containerID": "containerd://fef5decbc836b0a2093136c0cf2a09b79016cb347c0d9443c97cd80f9cced2bd", "exitCode": 0, "finishedAt": "2026-05-12T11:37:56Z", "reason": "Completed", "startedAt": "2026-05-12T11:37:46Z" }, "terminationReason": "Completed" }, { "container": "step-get-vulnerabilities", "imageID": "quay.io/konflux-ci/clair-in-ci@sha256:932d686d7695528116c4988e147284ae6faec0fe2333c362af01c70d5eb1448c", "name": "get-vulnerabilities", "provenance": {}, "terminated": { "containerID": "containerd://fc792e482c6509edc22088a433e5688a3087e4c7f80cb504b4dc1dddfcfcbe5d", "exitCode": 0, "finishedAt": "2026-05-12T11:37:59Z", "reason": "Completed", "startedAt": "2026-05-12T11:37:56Z" }, "terminationReason": "Completed" }, { "container": "step-oci-attach-report", "imageID": "quay.io/konflux-ci/oras@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705", "name": "oci-attach-report", "provenance": {}, "terminated": { "containerID": "containerd://75438043775b80cfdc676adb42c7fda1f458f7c0f280fe5522399919b542904f", "exitCode": 0, "finishedAt": "2026-05-12T11:38:02Z", "reason": "Completed", "startedAt": "2026-05-12T11:38:00Z" }, "terminationReason": "Completed" }, { "container": "step-conftest-vulnerabilities", "imageID": "quay.io/konflux-ci/konflux-test@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d", "name": "conftest-vulnerabilities", "provenance": {}, "terminated": { "containerID": "containerd://11aa0d95f1228500247572fd939ae862e1e552dc945df05d59c7c037fa0fd7ce", "exitCode": 0, "finishedAt": "2026-05-12T11:38:04Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e\\\", \\\"digests\\\": [\\\"sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b\\\"]}}\\n\",\"type\":1},{\"key\":\"REPORTS\",\"value\":\"{\\\"sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b\\\":\\\"sha256:8da5b53653cd6b28e369a809df2fb408498a786876da3a5308701a98e29ef483\\\"}\\n\",\"type\":1},{\"key\":\"SCAN_OUTPUT\",\"value\":\"{\\\"vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0},\\\"unpatched_vulnerabilities\\\":{\\\"critical\\\":0,\\\"high\\\":0,\\\"medium\\\":0,\\\"low\\\":0,\\\"unknown\\\":0}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"SUCCESS\\\",\\\"timestamp\\\":\\\"2026-05-12T11:38:04+00:00\\\",\\\"note\\\":\\\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\\\",\\\"namespace\\\":\\\"default\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":0}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-12T11:38:03Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans container images for vulnerabilities using Clair, by comparing the components of container image against Clair's vulnerability databases.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "The platform built by.", "name": "image-platform", "type": "string" }, { "default": "", "description": "unused, should be removed in next task version.", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-oci-attach-report", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Clair scan result.", "name": "SCAN_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" }, { "description": "Mapping of image digests to report digests", "name": "REPORTS", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e" }, { "name": "IMAGE_DIGEST", "value": "sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d", "name": "get-image-manifests", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck source=/dev/null\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\necho \"Inspecting raw image manifest $imageanddigest.\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"' | while read -r arch arch_sha; do\n echo \"$arch_sha\" \u003e /tekton/home/image-manifest-$arch.sha\n done\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task clair-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } } }, { "computeResources": { "limits": { "cpu": "800m", "memory": "7Gi" }, "requests": { "cpu": "800m", "memory": "7Gi" } }, "env": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e" }, { "name": "IMAGE_DIGEST", "value": "sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b" }, { "name": "IMAGE_PLATFORM" } ], "image": "quay.io/konflux-ci/clair-in-ci:v1", "imagePullPolicy": "Always", "name": "get-vulnerabilities", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n# shellcheck source=/utils.sh\n. /utils.sh\n\nimagewithouttag=$(echo -n $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\")\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\n# the quay report format used by the Conftest rules in the\n# conftest-vulnerabilities step doesn't contain the \"issued\" date which\n# we require in the policy rules, so we resort to running clair-action\n# twice to produce both quay and clair formatted output\nclair_report() {\n { retry clair-action report --image-ref=\"$1\" --db-path=/tmp/matcher.db --format=clair | tee \"clair-report-$2.json\"; } \u0026\u0026 \\\n { retry clair-action convert --file-path=\"clair-report-$2.json\" --format=quay \u003e \"clair-result-$2.json\"; }\n}\n\nrun_clair_on_arch() {\n local arch=\"$1\"\n local sha_file=\"image-manifest-$arch.sha\"\n\n if [ -e \"$sha_file\" ]; then\n local arch_sha\n arch_sha=$(\u003c\"$sha_file\")\n local digest=\"${imagewithouttag}@${arch_sha}\"\n\n echo \"Running clair-action on $arch image manifest...\"\n clair_report \"$digest\" \"$arch\" || true\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n fi\n}\n\nplatform=\"${IMAGE_PLATFORM}\"\n\n# If a platform is specified, extract the architecture and run clair-action on the corresponding image manifest\nif [ -n \"$platform\" ]; then\n arch=\"${platform#*/}\"\n if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n arch=\"amd64\"\n fi\n # Validate against supported arch list. If it's not a known arch, fallback to amd64\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n exit 0\n ;;\n esac\n\n run_clair_on_arch \"$arch\"\n\n# If no platform is specified, run clair-action on all available image manifests\nelse\n for sha_file in image-manifest-*.sha; do\n if [ -e \"$sha_file\" ]; then\n arch=$(basename \"$sha_file\" | sed 's/image-manifest-//;s/.sha//')\n run_clair_on_arch \"$arch\"\n fi\n done\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nimages_processed=$(echo \"${images_processed_template/\\[%s]/[$digests_processed_string]}\")\necho \"$images_processed\" \u003e images-processed.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_OCI_ATTACH_REPORT", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:d126f98e16bfad71aab782eb212a5be701e2cde915d294a7bd6423a4ab448705", "name": "oci-attach-report", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nif [ \"$SKIP_OCI_ATTACH_REPORT\" = \"true\" ]; then\n echo 'OCI attach report skipped by parameter.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\nif ! compgen -G \"clair-report-*.json\" \u003e /dev/null; then\n echo 'No Clair reports generated. Skipping upload.'\n echo '{}' \u003e reports.json\n exit 0\nfi\n\necho \"Selecting auth\"\nselect-oci-auth \"$IMAGE_URL\" \u003e \"$HOME/auth.json\"\n\nrepository=\"${IMAGE_URL/:*/}\"\n\narch() {\n report_file=\"$1\"\n arch=\"${report_file/*-}\"\n echo \"${arch/.json/}\"\n}\n\nMEDIA_TYPE='application/vnd.redhat.clair-report+json'\n\nreports_json=\"\"\nfor f in clair-report-*.json; do\n digest=$(cat \"image-manifest-$(arch \"$f\").sha\")\n image_ref=\"${repository}@${digest}\"\n echo \"Attaching $f to ${image_ref}\"\n if ! report_digest=\"$(retry oras attach --no-tty --format go-template='{{.digest}}' --registry-config \\\n \"$HOME/auth.json\" --artifact-type \"${MEDIA_TYPE}\" \"${image_ref}\" \"$f:${MEDIA_TYPE}\")\"\n then\n echo \"Failed to attach ${f} to ${image_ref}\"\n exit 1\n fi\n # shellcheck disable=SC2016\n reports_json=\"$(yq --output-format json --indent=0 eval-all '. as $i ireduce ({}; . * $i)' \u003c(echo \"${reports_json}\") \u003c(echo \"${digest}: ${report_digest}\"))\"\ndone\necho \"${reports_json}\" \u003e reports.json\n", "workingDir": "/tekton/home" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/konflux-test:v1.4.48@sha256:9b815268fb2bf10b5d745518da1c6568944f15816efe51adc192972b42a6e74d", "name": "conftest-vulnerabilities", "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nclair_result_files=$(ls /tekton/home/clair-result-*.json)\nif [ -z \"$clair_result_files\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: No clair-result files found in /tekton/home.\"\nfi\n\nmissing_vulnerabilities_files=\"\"\nfor file in $clair_result_files; do\n file_suffix=$(basename \"$file\" | sed 's/clair-result-//;s/.json//')\n if [ ! -s \"$file\" ]; then\n echo \"Previous step [get-vulnerabilities] failed: $file is empty.\"\n else\n /usr/bin/conftest test --no-fail $file \\\n --policy /project/clair/vulnerabilities-check.rego --namespace required_checks \\\n --output=json | tee /tekton/home/clair-vulnerabilities-$file_suffix.json || true\n fi\n\n #check for missing \"clair-vulnerabilities-\u003carch\u003e/image-index\" file and create a string\n if [ ! -f \"/tekton/home/clair-vulnerabilities-$file_suffix.json\" ]; then\n missing_vulnerabilities_files+=\"${missing_vulnerabilities_files:+, }/tekton/home/clair-vulnerabilities-$file_suffix.json\"\n fi\ndone\n\nif [ -n \"$missing_vulnerabilities_files\" ]; then\n note=\"Task clair-scan failed: $missing_vulnerabilities_files did not generate. For details, check Tekton task log.\"\n TEST_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"$missing_vulnerabilities_files did not generate correctly. For details, check conftest command in Tekton task log.\"\n echo \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n exit 0\nfi\n\nscan_result='{\"vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}, \"unpatched_vulnerabilities\":{\"critical\":0, \"high\":0, \"medium\":0, \"low\":0, \"unknown\":0}}'\nfor file in /tekton/home/clair-vulnerabilities-*.json; do\n result=$(jq -rce \\\n '{\n vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n },\n unpatched_vulnerabilities:{\n critical: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_critical_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n high: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_high_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n medium: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_medium_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n low: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_low_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0),\n unknown: (.[] | .warnings? // [] | map(select(.metadata.details.name==\"clair_unpatched_unknown_vulnerabilities\").metadata.\"vulnerabilities_number\" // 0)| add // 0)\n }\n }' \"$file\")\n\n scan_result=$(jq -s -rce \\\n '.[0].vulnerabilities.critical += .[1].vulnerabilities.critical |\n .[0].vulnerabilities.high += .[1].vulnerabilities.high |\n .[0].vulnerabilities.medium += .[1].vulnerabilities.medium |\n .[0].vulnerabilities.low += .[1].vulnerabilities.low |\n .[0].vulnerabilities.unknown += .[1].vulnerabilities.unknown |\n .[0].unpatched_vulnerabilities.critical += .[1].unpatched_vulnerabilities.critical |\n .[0].unpatched_vulnerabilities.high += .[1].unpatched_vulnerabilities.high |\n .[0].unpatched_vulnerabilities.medium += .[1].unpatched_vulnerabilities.medium |\n .[0].unpatched_vulnerabilities.low += .[1].unpatched_vulnerabilities.low |\n .[0].unpatched_vulnerabilities.unknown += .[1].unpatched_vulnerabilities.unknown |\n .[0]' \u003c\u003c\u003c\"$scan_result $result\")\ndone\n\necho \"$scan_result\" | tee \"/tekton/results/SCAN_OUTPUT\"\n\ncat /tekton/home/images-processed.json | tee /tekton/results/IMAGES_PROCESSED\n# shellcheck disable=SC2154\ncat /tekton/home/reports.json \u003e \"/tekton/results/REPORTS\"\n\nnote=\"Task clair-scan completed: Refer to Tekton task result SCAN_OUTPUT for vulnerabilities scanned by Clair.\"\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"$note\")\necho \"${TEST_OUTPUT}\" | tee /tekton/results/TEST_OUTPUT\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } } } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ezwfnw/-/tree/219b80c26cab889ef11052f7ffaa2bd3be8df61e", "build.appstudio.redhat.com/commit_sha": "219b80c26cab889ef11052f7ffaa2bd3be8df61e", "build.appstudio.redhat.com/target_branch": "base-atzqqx", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-atzqqx", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uefukb", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/log-url": "https://35.155.109.137:9443/ns/build-e2e-yoqc/pipelinerun/gl-test-custom-branch-qtsekv-on-push-5v5pq", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-atzqqx\"", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-qtsekv-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ezwfnw", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ezwfnw", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "219b80c26cab889ef11052f7ffaa2bd3be8df61e", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ezwfnw/-/commit/219b80c26cab889ef11052f7ffaa2bd3be8df61e", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-atzqqx", "pipelinesascode.tekton.dev/source-project-id": "82123586", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ezwfnw", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/target-project-id": "82123586", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ezwfnw", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-yoqc/results/936ada68-174e-4cd3-8b13-bbd6261fbe88/records/736286d0-fce4-4593-97a5-3c65c6e10540", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-ezwfnw\",\"commit\":\"219b80c26cab889ef11052f7ffaa2bd3be8df61e\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-yoqc/results/936ada68-174e-4cd3-8b13-bbd6261fbe88", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "virus, konflux" }, "creationTimestamp": "2026-05-12T11:37:28Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-05-12T11:38:11Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-guwv", "appstudio.openshift.io/component": "gl-test-custom-branch-qtsekv", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-qtsekv-on-push", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ezwfnw", "pipelinesascode.tekton.dev/sha": "219b80c26cab889ef11052f7ffaa2bd3be8df61e", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ezwfnw", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-test-custom-branch-qtsekv-on-push-5v5pq", "tekton.dev/pipelineRun": "gl-test-custom-branch-qtsekv-on-push-5v5pq", "tekton.dev/pipelineRunUID": "936ada68-174e-4cd3-8b13-bbd6261fbe88", "tekton.dev/pipelineTask": "clamav-scan", "tekton.dev/task": "clamav-scan" }, "name": "gl-test-custom-branch-qtsekv-on-push-5v5pq-clamav-scan", "namespace": "build-e2e-yoqc", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-test-custom-branch-qtsekv-on-push-5v5pq", "uid": "936ada68-174e-4cd3-8b13-bbd6261fbe88" } ], "resourceVersion": "30019", "uid": "736286d0-fce4-4593-97a5-3c65c6e10540" }, "spec": { "params": [ { "name": "image-digest", "value": "sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b" }, { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e" } ], "serviceAccountName": "build-pipeline-gl-test-custom-branch-qtsekv", "taskRef": { "params": [ { "name": "name", "value": "clamav-scan" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-12T11:38:08Z", "conditions": [ { "lastTransitionTime": "2026-05-12T11:38:08Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-test-custom-branch-qtsekv-on-push-5v5pq-clamav-scan-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "9f18b216ce71a66909e7cb17d9b34526c02d73cf12884ba32d1f10614f7b9f5a" }, "entryPoint": "clamav-scan", "uri": "quay.io/konflux-ci/tekton-catalog/task-clamav-scan" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e\", \"digests\": [\"sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1778585884\",\"namespace\":\"required_checks\",\"successes\":2,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\",\"note\":\"All checks passed successfully\"}\n" } ], "startTime": "2026-05-12T11:37:29Z", "steps": [ { "container": "step-extract-and-scan-image", "imageID": "quay.io/konflux-ci/clamav-db@sha256:bcc5c96bcf0508cd381c2b442ff2d8af434e89a7aee96fc5c3cf3a2ddf634dca", "name": "extract-and-scan-image", "provenance": {}, "terminated": { "containerID": "containerd://256b2b31f397a45be96a4e7916fc7a48c8401429eef9a9baca06ec3c16a6d6ce", "exitCode": 0, "finishedAt": "2026-05-12T11:38:04Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e\\\", \\\"digests\\\": [\\\"sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778585884\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-12T11:37:45Z" }, "terminationReason": "Completed" }, { "container": "step-upload", "imageID": "quay.io/konflux-ci/oras@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e", "name": "upload", "provenance": {}, "terminated": { "containerID": "containerd://6fb65b598339e5fde16deb3f94e751c00eb556e6e7124b549ab2b89e169b3af1", "exitCode": 0, "finishedAt": "2026-05-12T11:38:07Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e\\\", \\\"digests\\\": [\\\"sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1778585884\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":2,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\",\\\"note\\\":\\\"All checks passed successfully\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-05-12T11:38:04Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans the content of container images and OCI artifacts for viruses, malware, and other malicious content using ClamAV antivirus scanner.", "params": [ { "description": "Image digest to scan.", "name": "image-digest", "type": "string" }, { "description": "Image URL.", "name": "image-url", "type": "string" }, { "default": "", "description": "Image arch.", "name": "image-arch", "type": "string" }, { "default": "", "description": "unused", "name": "docker-auth", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "8", "description": "Maximum number of threads clamd runs.", "name": "clamd-max-threads", "type": "string" }, { "default": "false", "description": "If true, skips uploading the results to the image registry. Useful for read-only tests.", "name": "skip-upload", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "7300m", "memory": "12Gi" }, "requests": { "cpu": "7300m", "memory": "12Gi" } }, "env": [ { "name": "HOME", "value": "/work" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e" }, { "name": "IMAGE_DIGEST", "value": "sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b" }, { "name": "IMAGE_ARCH" }, { "name": "MAX_THREADS", "value": "8" } ], "image": "quay.io/konflux-ci/clamav-db:latest", "name": "extract-and-scan-image", "script": "#!/usr/bin/env bash\nset -euo pipefail\n. /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\n# Start clamd in background\n/start-clamd.sh\n\n# Bootstrap .docker config in overridden HOME.\n# This prevents 'oc' CLI failures in clean environments where ~/.docker does not exist.\nif [ ! -d ~/.docker ]; then\n mkdir -p ~/.docker\n echo '{}' \u003e ~/.docker/config.json\nfi\n\nimagewithouttag=$(echo $IMAGE_URL | sed \"s/\\(.*\\):.*/\\1/\" | tr -d '\\n')\n\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=$(echo $imagewithouttag@$IMAGE_DIGEST)\n\n# check if image is attestation one, skip the clamav scan in such case\nif [[ $imageanddigest == *.att ]]\nthen\n echo \"$imageanddigest is an attestation image. Skipping ClamAV scan.\"\n exit 0\nfi\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\nmkdir logs\nmkdir content\ncd content\necho \"Detecting artifact type for ${imageanddigest}.\"\necho '{\"artifact\":{\"pullspec\":\"'\"${imageanddigest}\"'\",\"type\":\"unknown\",\"mediaType\":\"\"}}' \u003e /work/logs/artifact-meta.json\n\n# Function to scan content and process results with ClamAV and EC\n# Parameters:\n# $1: destination - path to the content to scan\n# $2: suffix - suffix for log file names (e.g., \"oci\", \"amd64\")\n# $3: digest - digest to add to digests_processed array\n# $4: scan_message - optional message describing what is being scanned\nscan_and_process() {\n local destination=\"$1\"\n local suffix=\"$2\"\n local digest=\"$3\"\n local scan_message=\"${4:-Scanning content}\"\n\n db_version=$(clamdscan --version | sed 's|.*/\\(.*\\)/.*|\\1|')\n\n echo \"$scan_message. This operation may take a while.\"\n clamdscan \"${destination}\" -vi --multiscan --fdpass \\\n | tee \"/work/logs/clamscan-result-${suffix}.log\" || true\n\n echo \"Executed-on: Scan was executed on clamsdcan version - $(clamdscan --version) Database version: $db_version\" | tee -a \"/work/logs/clamscan-result-${suffix}.log\"\n\n digests_processed+=(\"\\\"$digest\\\"\")\n\n if [[ -e \"/work/logs/clamscan-result-${suffix}.log\" ]]; then\n # OPA/EC requires structured data input, add clamAV log into json\n jq -Rs '{ output: . }' \"/work/logs/clamscan-result-${suffix}.log\" \u003e \"/work/logs/clamscan-result-log-${suffix}.json\"\n\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o json \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" || true\n\n # workaround: due to a bug in ec-cli, we cannot generate json and appstudio output at the same time, running it again\n EC_EXPERIMENTAL=1 ec test \\\n --namespace required_checks \\\n --policy /project/clamav/virus-check.rego \\\n -o appstudio \\\n \"/work/logs/clamscan-result-log-${suffix}.json\" | tee \"/work/logs/clamscan-ec-test-${suffix}.json\" || true\n\n cat \"/work/logs/clamscan-ec-test-${suffix}.json\"\n fi\n}\n\n# Detect artifact type: container image vs OCI artifact\n# First, try to get image manifests (works for container images)\n# Use subshell to prevent get_image_manifests() from exiting the main script if it fails\n# (get_image_manifests uses exit 1 when Architecture field is missing, which happens for OCI artifacts)\nimage_manifests=$(bash -c '. /utils.sh; get_image_manifests -i \"'\"${imageanddigest}\"'\"' 2\u003e/dev/null || echo \"\")\n\n# If get_image_manifests failed, check if it's an OCI artifact by inspecting manifest media type\nif [ -z \"$image_manifests\" ]; then\n echo \"get_image_manifests returned empty, checking if this is an OCI artifact...\"\n raw_manifest=$(skopeo inspect --raw --authfile ~/.docker/config.json \"docker://${imageanddigest}\" 2\u003e/dev/null || true)\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"inspected\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n\n if [ -n \"$raw_manifest\" ]; then\n media_type=$(echo \"$raw_manifest\" | jq -r '.mediaType // .config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n artifact_type=$(echo \"$raw_manifest\" | jq -r '.artifactType // empty' 2\u003e/dev/null || echo \"\")\n config_media_type=$(echo \"$raw_manifest\" | jq -r '.config.mediaType // empty' 2\u003e/dev/null || echo \"\")\n\n # Determine if this is an OCI artifact (not a container image)\n # OCI artifacts typically have:\n # - An empty/scratch config (config.mediaType contains \"empty\" or \"scratch\")\n # - An explicit artifactType field that is not a container image type\n is_oci_artifact=false\n\n # Check if config is empty/scratch (typical for OCI artifacts like python wheels, helm charts, etc.)\n if echo \"$config_media_type\" | grep -qiE \"(empty|scratch)\"; then\n is_oci_artifact=true\n fi\n\n # Check if artifactType is set and is not a container image type\n if [ -n \"$artifact_type\" ] \u0026\u0026 ! echo \"$artifact_type\" | grep -qE \"application/vnd\\.(oci|docker)\\.(image|container)\"; then\n is_oci_artifact=true\n fi\n\n if [ \"$is_oci_artifact\" = true ]; then\n # This is an OCI artifact (e.g., python wheels, helm charts, etc.)\n echo \"Detected OCI artifact (artifactType: ${artifact_type:-unset}, config.mediaType: ${config_media_type:-unset}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.artifactType = '\"\\\"${artifact_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n elif echo \"$media_type\" | grep -qE \"(application/vnd\\.(docker|oci)\\.(distribution|image)\\.manifest|application/vnd\\.docker\\.distribution\\.manifest)\"; then\n # This looks like a container image manifest, but get_image_manifests failed\n echo \"Detected container image manifest type: $media_type, but get_image_manifests failed. This may indicate an error.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"$media_type\\\"\"' | .artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n note=\"Task clamav-scan failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n else\n # Likely an OCI artifact with non-standard media type\n echo \"Detected OCI artifact (media type: ${media_type:-unknown}). Downloading for scanning...\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.mediaType = '\"\\\"${media_type:-unknown}\\\"\"' | .artifact.type = \"oci\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n destination=\"content-oci\"\n mkdir -p \"$destination\"\n\n # Download OCI artifact using skopeo copy\n echo \"Downloading OCI artifact using skopeo copy\"\n if ! retry skopeo copy --authfile ~/.docker/config.json \"docker://${imageanddigest}\" \"dir:${destination}\" 2\u003e\u00261; then\n echo \"Failed to download OCI artifact \\\"$imageanddigest\\\". Skipping ClamAV scan!\"\n note=\"Task clamav-scan failed: Failed to download OCI artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\n\n # Scan and process OCI artifact\n scan_and_process \"${destination}\" \"oci\" \"$IMAGE_DIGEST\" \"Scanning OCI artifact\"\n\n # Skip the container image processing path\n image_manifests=\"\"\n fi\n else\n echo \"Failed to inspect artifact \\\"$imageanddigest\\\". Unable to determine type.\"\n note=\"Task clamav-scan failed: Failed to inspect artifact \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\n fi\nfi\n\n# Process container images (existing logic)\nif [ -n \"$image_manifests\" ]; then\n echo \"Detected container image. Processing image manifests.\"\n if [ -s /work/logs/artifact-meta.json ]; then\n tmp=$(mktemp)\n if jq '.artifact.type = \"image\"' /work/logs/artifact-meta.json \u003e \"$tmp\"; then\n mv \"$tmp\" /work/logs/artifact-meta.json || true\n fi\n fi\n # Proceed only if a specific arch is provided.\n # This typically occurs when using Tekton Matrix to launch multiple TaskRuns to scan all architectures of a multi-arch image in parallel.\n if [ -n \"$IMAGE_ARCH\" ]; then\n arch=\"${IMAGE_ARCH#*/}\"\n if [ \"${arch}\" = \"x86_64\" ]; then\n arch=\"amd64\"\n fi\n\n # Check if arch is supported; if not (e.g., it's 'local', see link below), default to amd64.\n # https://github.com/redhat-appstudio/infra-deployments/blob/main/components/multi-platform-controller/production/stone-prd-rh01/host-config.yaml#L9-L14\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n arch=\"amd64\"\n ;;\n esac\n\n image_manifests=$(echo \"$image_manifests\" | jq -c --arg arch \"$arch\" '{($arch): .[$arch]}')\n fi\n\n while read -r arch arch_sha; do\n destination=$(echo content-$arch)\n mkdir -p \"$destination\"\n arch_imageanddigest=$(echo $imagewithouttag@$arch_sha)\n\n echo \"Running \\\"oc image extract\\\" on image of arch $arch\"\n retry oc image extract --only-files=true --registry-config ~/.docker/config.json \"$arch_imageanddigest\" --path=\"/:${destination}\" --filter-by-os=\"linux/${arch}\"\n if [ $? -ne 0 ]; then\n echo \"Unable to extract image for arch $arch. Skipping ClamAV scan!\"\n exit 0\n fi\n\n # Scan and process container image for this architecture\n scan_and_process \"${destination}\" \"$arch\" \"$arch_sha\" \"Scanning image for arch $arch\"\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nfi\n\njq -s -rce '\n reduce .[] as $item ({\"timestamp\":\"0\",\"namespace\":\"\",\"successes\":0,\"failures\":0,\"warnings\":0,\"result\":\"\",\"note\":\"\"};\n {\n \"timestamp\" : (if .timestamp \u003c $item.timestamp then $item.timestamp else .timestamp end),\n \"namespace\" : $item.namespace,\n \"successes\" : (.successes + $item.successes),\n \"failures\" : (.failures + $item.failures),\n \"warnings\" : (.warnings + $item.warnings),\n \"result\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.result else .result end),\n \"note\" : (if .result == \"\" or ($item.result == \"SKIPPED\" and .result == \"SUCCESS\") or ($item.result == \"WARNING\" and (.result == \"SUCCESS\" or .result == \"SKIPPED\")) or ($item.result == \"FAILURE\" and .result != \"ERROR\") or $item.result == \"ERROR\" then $item.note else .note end)\n })' /work/logs/clamscan-ec-test-*.json | tee /tekton/results/TEST_OUTPUT\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee /tekton/results/IMAGES_PROCESSED\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] } }, "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SKIP_UPLOAD", "value": "false" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e" }, { "name": "IMAGE_DIGEST", "value": "sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b" } ], "image": "quay.io/konflux-ci/oras:latest@sha256:f322638a8a337f26adda3f72d3fbcf7e1218a6d8d7e2365376487417a05e0f4e", "name": "upload", "script": "#!/usr/bin/env bash\nset -e\n\n# Skip upload if requested e.g. read-only CI tests where push access is denied\nif [ \"$SKIP_UPLOAD\" == \"true\" ]; then\n echo \"Upload skipped by parameter.\"\n exit 0\nfi\n\n# Don't return a glob expression when no matches are found\nshopt -s nullglob\n\ncd logs\n\nfor UPLOAD_FILE in clamscan-result*.log; do\n MEDIA_TYPE=text/vnd.clamav\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\nfor UPLOAD_FILE in clamscan-ec-test*.json; do\n MEDIA_TYPE=application/vnd.konflux.test_output+json\n args+=(\"${UPLOAD_FILE}:${MEDIA_TYPE}\")\ndone\n\nif [ -z \"${args}\" ]; then\n echo \"No files found. Skipping upload.\"\n exit 0;\nfi\n\necho \"Selecting auth\"\nselect-oci-auth $IMAGE_URL \u003e $HOME/auth.json\necho \"Attaching to ${IMAGE_URL}\"\n retry oras attach --no-tty --registry-config \"$HOME/auth.json\" --artifact-type application/vnd.clamav \"${IMAGE_URL}@${IMAGE_DIGEST}\" \"${args[@]}\"\n", "volumeMounts": [ { "mountPath": "/work", "name": "work" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/work" } ], "volumes": [ { "emptyDir": {}, "name": "dbfolder" }, { "emptyDir": {}, "name": "work" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ezwfnw/-/tree/219b80c26cab889ef11052f7ffaa2bd3be8df61e", "build.appstudio.redhat.com/commit_sha": "219b80c26cab889ef11052f7ffaa2bd3be8df61e", "build.appstudio.redhat.com/target_branch": "base-atzqqx", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-atzqqx", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-uefukb", "pipelinesascode.tekton.dev/git-provider": "gitlab", "pipelinesascode.tekton.dev/log-url": "https://35.155.109.137:9443/ns/build-e2e-yoqc/pipelinerun/gl-test-custom-branch-qtsekv-on-push-5v5pq", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-atzqqx\"", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-qtsekv-on-push", "pipelinesascode.tekton.dev/repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ezwfnw", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ezwfnw", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "219b80c26cab889ef11052f7ffaa2bd3be8df61e", "pipelinesascode.tekton.dev/sha-title": "e2e test commit message", "pipelinesascode.tekton.dev/sha-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ezwfnw/-/commit/219b80c26cab889ef11052f7ffaa2bd3be8df61e", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-atzqqx", "pipelinesascode.tekton.dev/source-project-id": "82123586", "pipelinesascode.tekton.dev/source-repo-url": "https://gitlab.com/konflux-qe/devfile-sample-hello-world-ezwfnw", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/target-project-id": "82123586", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ezwfnw", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-yoqc/results/936ada68-174e-4cd3-8b13-bbd6261fbe88/records/aaa99b4a-7bba-43b9-88d8-521af7ec27c9", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-ezwfnw\",\"commit\":\"219b80c26cab889ef11052f7ffaa2bd3be8df61e\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-yoqc/results/936ada68-174e-4cd3-8b13-bbd6261fbe88", "results.tekton.dev/stored": "true" }, "creationTimestamp": "2026-05-12T11:37:28Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-05-12T11:38:11Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-guwv", "appstudio.openshift.io/component": "gl-test-custom-branch-qtsekv", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "gl-test-custom-branch-qtsekv-on-push", "pipelinesascode.tekton.dev/repository": "gitlab.com.konflux-qe.devfile-sample-hello-world-ezwfnw", "pipelinesascode.tekton.dev/sha": "219b80c26cab889ef11052f7ffaa2bd3be8df61e", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-ezwfnw", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "gl-test-custom-branch-qtsekv-on-push-5v5pq", "tekton.dev/pipelineRun": "gl-test-custom-branch-qtsekv-on-push-5v5pq", "tekton.dev/pipelineRunUID": "936ada68-174e-4cd3-8b13-bbd6261fbe88", "tekton.dev/pipelineTask": "ecosystem-cert-preflight-checks", "tekton.dev/task": "ecosystem-cert-preflight-checks" }, "name": "gl-test-custom-branch-qtsekv-one92e5016621d2d0644323a69fb2d7a58", "namespace": "build-e2e-yoqc", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "gl-test-custom-branch-qtsekv-on-push-5v5pq", "uid": "936ada68-174e-4cd3-8b13-bbd6261fbe88" } ], "resourceVersion": "30014", "uid": "aaa99b4a-7bba-43b9-88d8-521af7ec27c9" }, "spec": { "params": [ { "name": "image-url", "value": "quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e" } ], "serviceAccountName": "build-pipeline-gl-test-custom-branch-qtsekv", "taskRef": { "params": [ { "name": "name", "value": "ecosystem-cert-preflight-checks" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-05-12T11:38:06Z", "conditions": [ { "lastTransitionTime": "2026-05-12T11:38:06Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "gl-test-custom-branch-qtsek002b9ab0958a591a507a77d137f2b043-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850" }, "entryPoint": "ecosystem-cert-preflight-checks", "uri": "quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks" } }, "results": [ { "name": "ARTIFACT_TYPE", "type": "string", "value": "application" }, { "name": "ARTIFACT_TYPE_SET_BY", "type": "string", "value": "introspection" }, { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e\", \"digests\": [\"sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b\"]}}" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778585883\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":4,\"failures\":3,\"warnings\":0}" } ], "startTime": "2026-05-12T11:37:28Z", "steps": [ { "container": "step-introspect", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "introspect", "provenance": {}, "results": [ { "name": "artifact-type", "type": "string", "value": "application" }, { "name": "artifact-type-set-by", "type": "string", "value": "introspection" } ], "terminated": { "containerID": "containerd://cef617e7e3d588dab375665b4162b37b7a5f6f2462a29fdf2c38afd25204dd62", "exitCode": 0, "finishedAt": "2026-05-12T11:37:48Z", "message": "[{\"key\":\"artifact-type\",\"value\":\"application\",\"type\":4},{\"key\":\"artifact-type-set-by\",\"value\":\"introspection\",\"type\":4}]", "reason": "Completed", "startedAt": "2026-05-12T11:37:45Z" }, "terminationReason": "Completed" }, { "container": "step-generate-container-auth", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "generate-container-auth", "provenance": {}, "results": [ { "name": "auth-json-path", "type": "string", "value": "/auth/auth.json" } ], "terminated": { "containerID": "containerd://1a450c51b3eca068eb5969e20a15aea54e0454b90a41da14f8583c4de9da373d", "exitCode": 0, "finishedAt": "2026-05-12T11:37:48Z", "message": "[{\"key\":\"auth-json-path\",\"value\":\"/auth/auth.json\",\"type\":4}]", "reason": "Completed", "startedAt": "2026-05-12T11:37:48Z" }, "terminationReason": "Completed" }, { "container": "step-set-skip-for-bundles", "imageID": "quay.io/redhat-appstudio/konflux-test@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1", "name": "set-skip-for-bundles", "provenance": {}, "terminated": { "containerID": "containerd://273f0a4a8a5ffd7012f62eb88022d7a53c3aefc7f419aff10ec265b395515c90", "exitCode": 0, "finishedAt": "2026-05-12T11:37:49Z", "reason": "Completed", "startedAt": "2026-05-12T11:37:49Z" }, "terminationReason": "Skipped" }, { "container": "step-app-check", "imageID": "quay.io/opdev/preflight@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1", "name": "app-check", "provenance": {}, "terminated": { "containerID": "containerd://3aff194935fb341fe04515f958f6938ef1cb9a0d3501fce785feb486665828c2", "exitCode": 0, "finishedAt": "2026-05-12T11:38:02Z", "reason": "Completed", "startedAt": "2026-05-12T11:37:49Z" }, "terminationReason": "Completed" }, { "container": "step-app-set-outcome", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "app-set-outcome", "provenance": {}, "results": [ { "name": "images-processed", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e\", \"digests\": [\"sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b\"]}}" }, { "name": "test-output", "type": "string", "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778585883\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":4,\"failures\":3,\"warnings\":0}" } ], "terminated": { "containerID": "containerd://0e537347d54894ad1ab2a8f6d5b5690dc86d51bc5ea01fbefa83fab82272dfb4", "exitCode": 0, "finishedAt": "2026-05-12T11:38:04Z", "message": "[{\"key\":\"images-processed\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e\\\", \\\"digests\\\": [\\\"sha256:9007e77097d9a98cd62990282defdcbd8fa6a12e2febbcc9f828a2fe989c672b\\\"]}}\",\"type\":4},{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778585883\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":4,\\\"failures\\\":3,\\\"warnings\\\":0}\",\"type\":4}]", "reason": "Completed", "startedAt": "2026-05-12T11:38:03Z" }, "terminationReason": "Completed" }, { "container": "step-final-outcome", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "final-outcome", "provenance": {}, "results": [ { "name": "test-output", "type": "string", "value": "{\"result\":\"ERROR\",\"timestamp\":\"1778585883\",\"note\":\"Task preflight is a ERROR: Refer to Tekton task logs for more information\",\"successes\":4,\"failures\":3,\"warnings\":0}" } ], "terminated": { "containerID": "containerd://b57931424c5128151edf7c97c0685f146a6fe03845eacb538221be823567b7b2", "exitCode": 0, "finishedAt": "2026-05-12T11:38:05Z", "message": "[{\"key\":\"test-output\",\"value\":\"{\\\"result\\\":\\\"ERROR\\\",\\\"timestamp\\\":\\\"1778585883\\\",\\\"note\\\":\\\"Task preflight is a ERROR: Refer to Tekton task logs for more information\\\",\\\"successes\\\":4,\\\"failures\\\":3,\\\"warnings\\\":0}\",\"type\":4}]", "reason": "Completed", "startedAt": "2026-05-12T11:38:05Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Scans container images for certification readiness. Note that running this against an operatorbundle will result in a skip, as bundle validation is not executed through this task.", "params": [ { "description": "Image url to scan.", "name": "image-url", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "ca-trust-config-map-name", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "ca-trust-config-map-key", "type": "string" }, { "default": "introspect", "description": "The type of artifact. Select from application, operatorbundle, or introspect.", "name": "artifact-type", "type": "string" }, { "default": "", "description": "The platform the image is built on.", "name": "platform", "type": "string" } ], "results": [ { "description": "Ecosystem checks pass or fail outcome.", "name": "TEST_OUTPUT", "type": "string", "value": "$(steps.final-outcome.results.test-output)" }, { "description": "The artifact type, either introspected or set.", "name": "ARTIFACT_TYPE", "type": "string", "value": "$(steps.introspect.results.artifact-type)" }, { "description": "How the artifact type was set.", "name": "ARTIFACT_TYPE_SET_BY", "type": "string", "value": "$(steps.introspect.results.artifact-type-set-by)" }, { "description": "Collected image digests", "name": "IMAGES_PROCESSED", "type": "string", "value": "$(steps.app-set-outcome.results.images-processed)" } ], "steps": [ { "computeResources": { "limits": { "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "env": [ { "name": "PARAM_ARTIFACT_TYPE", "value": "introspect" }, { "name": "PARAM_IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "introspect", "results": [ { "description": "The type of artifact this task is considering.", "name": "artifact-type" }, { "description": "The process that sets the artifact type. Informational.\nValues from: introspection, parameter.\n", "name": "artifact-type-set-by" } ], "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n_SET_BY=parameter\n# If the parameter is invalid, we'll introspect\nif [[ \"${PARAM_ARTIFACT_TYPE}\" != \"application\" ]] \u0026\u0026 [[ \"${PARAM_ARTIFACT_TYPE}\" != \"operatorbundle\" ]]; then\n echo \"Artifact type will be determined by introspection.\"\n _SET_BY=introspection\nfi\nprintf \"%s\" \"${_SET_BY}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type-set-by\"\n\nif [[ \"${_SET_BY}\" == \"parameter\" ]]; then\n # short circuit if the artifact type was set via parameter.\n echo \"Skipping introspection because the artifact-type parameter is explicitly set to \\\"${PARAM_ARTIFACT_TYPE}\\\".\"\n printf \"%s\" \"${PARAM_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\n exit 0\nfi\n\n# If the image URL points to a manifest list (a multi-arch image), check the labels on any of the child\n# images (don't fail in the case where the list does not include an image for the arch of the system\n# where this pipeline is running).\n\ndeclare -a _SKOPEO_INSPECT_ARGS\n\nskopeo_retries=3\n\necho \"Checking the media type of the OCI artifact...\"\nif ! _RAW_IMAGE_MANIFEST=$(retry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\")\nthen\n echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n exit 1\nfi\n_IMAGE_MEDIA_TYPE=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.mediaType')\necho \"The media type of the OCI artifact is ${_IMAGE_MEDIA_TYPE}.\"\n\nif [[ \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.docker.distribution.manifest.list.v2+json\" || \"${_IMAGE_MEDIA_TYPE}\" == \"application/vnd.oci.image.index.v1+json\" ]]; then\n _CURRENT_ARCH=$(uname -m)\n _CURRENT_OS=$(uname -s | tr '[:upper:]' '[:lower:]')\n\n # The archs returned by uname are not always the same as the archs used by OCI manifests, so we need\n # to map them.\n case ${_CURRENT_ARCH} in\n \"aarch64\")\n _CURRENT_ARCH=\"arm64\"\n ;;\n \"x86_64\")\n _CURRENT_ARCH=\"amd64\"\n ;;\n *)\n ;;\n esac\n\n # If the manifest list contains an image for the current OS and architecture, prefer to test that.\n _MATCHING_IMAGE_COUNT=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r \"[.manifests[] | select(.platform.os == \\\"${_CURRENT_OS}\\\" and .platform.architecture == \\\"${_CURRENT_ARCH}\\\")] | length\")\n if [[ \"${_MATCHING_IMAGE_COUNT}\" -gt 0 ]]; then\n echo \"Found an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}).\"\n else\n # If there is no image for the current OS and architecture, just use the first one in the list.\n _INSPECT_OVERRIDE_IMAGE_OS=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.os')\n _INSPECT_OVERRIDE_IMAGE_ARCH=$(printf \"%s\" \"${_RAW_IMAGE_MANIFEST}\" | jq -r '.manifests[0].platform.architecture')\n _SKOPEO_INSPECT_ARGS+=(\"--override-os=${_INSPECT_OVERRIDE_IMAGE_OS}\")\n _SKOPEO_INSPECT_ARGS+=(\"--override-arch=${_INSPECT_OVERRIDE_IMAGE_ARCH}\")\n\n echo \"Could not find an image in the manifests for the current OS and architecture (${_CURRENT_OS}/${_CURRENT_ARCH}), inspecting the image for ${_INSPECT_OVERRIDE_IMAGE_OS}/${_INSPECT_OVERRIDE_IMAGE_ARCH} instead.\"\n fi\nfi\n\n# Introspect based on minimum count of operator-framework related bundle labels.\necho \"Looking for image labels that indicate this might be an operator bundle...\"\n\n# We purposely do not quote the array elements here, so that they are expanded by the shell as separate args.\n# shellcheck disable=SC2068\nif ! retry skopeo inspect --retry-times \"$skopeo_retries\" ${_SKOPEO_INSPECT_ARGS[@]} \"docker://${PARAM_IMAGE_URL}\" \\\n | jq '.Labels | keys | .[]' -r \\\n | { grep operators.operatorframework.io.bundle || true ;} \\\n | tee /tmp/ecosystem-image-labels\nthen\n echo \"Failed to inspect ${PARAM_IMAGE_URL}\"\n exit 1\nfi\n\n_OPFW_LABEL_COUNT=$(grep -c operators.operatorframework.io.bundle /tmp/ecosystem-image-labels || true)\n_MIN_LABELS=3\n\necho \"Found ${_OPFW_LABEL_COUNT} matching labels.\"\necho \"Expecting ${_MIN_LABELS} or more to identify this image as an operator bundle.\"\n\n# If the image has several labels, assume it is an operator\n_ARTIFACT_TYPE=application\n(( _OPFW_LABEL_COUNT \u003e= _MIN_LABELS )) \u0026\u0026 _ARTIFACT_TYPE=operatorbundle\n\nprintf \"%s\" \"${_ARTIFACT_TYPE}\" \u003e \"/tekton/steps/step-introspect/results/artifact-type\"\necho \"Introspection concludes that this artifact is of type \\\"${_ARTIFACT_TYPE}\\\".\"\n" }, { "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "50m", "memory": "64Mi" } }, "env": [ { "name": "PARAM_IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "generate-container-auth", "results": [ { "description": "Path to auth.json", "name": "auth-json-path" } ], "script": "_AUTH_JSON_PATH=\"/auth/auth.json\"\necho \"Selecting auth for $PARAM_IMAGE_URL\"\n# `select-oci-auth` here assumes the input credentials are at path ~/.docker/config.json\nselect-oci-auth \"$PARAM_IMAGE_URL\" \u003e \"${_AUTH_JSON_PATH}\"\n\nprintf \"%s\" \"${_AUTH_JSON_PATH}\" \u003e \"/tekton/steps/step-generate-container-auth/results/auth-json-path\"\necho \"Auth json written to \\\"${_AUTH_JSON_PATH}\\\".\"\n", "volumeMounts": [ { "mountPath": "/auth", "name": "auth" } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/redhat-appstudio/konflux-test:v1.4.31@sha256:a7cae9e96663e277a3904d0c78630508ddb6cc8eebaa912a840bd20f68dcaad1", "name": "set-skip-for-bundles", "results": [ { "description": "A skipped tekton result for bundles.", "name": "test-output" } ], "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nNOTE=\"This ecosystem check is not executed for operatorbundles.\"\n\n# shellcheck source=/dev/null\n. /utils.sh # gives us the make_result_json helper used below.\n\n# Generate TEST_OUTPUT\n# We're skipping the test, but don't use status \"SKIPPED\" because\n# it produces unwanted Conforma violations\nTEST_OUTPUT=$(make_result_json -r \"SUCCESS\" -t \"${NOTE}\")\n\nprintf \"%s\" \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-set-skip-for-bundles/results/test-output\" /bundle/konflux.results.json\n", "volumeMounts": [ { "mountPath": "/bundle", "name": "pfltoutputdir" } ], "when": [ { "input": "$(steps.introspect.results.artifact-type)", "operator": "in", "values": [ "operatorbundle" ] } ] }, { "computeResources": { "limits": { "memory": "4Gi" }, "requests": { "cpu": "1", "memory": "4Gi" } }, "env": [ { "name": "PFLT_DOCKERCONFIG", "value": "$(steps.generate-container-auth.results.auth-json-path)" }, { "name": "PFLT_KONFLUX", "value": "true" }, { "name": "PARAM_IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e" }, { "name": "PARAM_PLATFORM" } ], "image": "quay.io/opdev/preflight:stable@sha256:2f9816292f4dec166c03d913d7e8b9673f9313bc5220a5b82efb0923b81095b1", "name": "app-check", "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\nimage_url=\"${PARAM_IMAGE_URL}\"\nplatform=\"${PARAM_PLATFORM}\"\n\nif [ -n \"$platform\" ]; then\n # Extract part after slash if present\n arch=\"${platform#*/}\"\n if [ \"$arch\" = \"x86_64\" ] || [ \"$arch\" = \"local\" ] || [ \"$arch\" = \"localhost\" ]; then\n arch=\"amd64\"\n fi\n\n # Validate against supported arch list. If it's not a known arch, return an error result\n case \"$arch\" in\n amd64|ppc64le|arm64|s390x)\n ;;\n *)\n echo \"Error: Unsupported or malformed architecture: '$arch' (parsed from platform: '$platform')\"\n exit 0\n ;;\n esac\n\n /usr/local/bin/preflight check container \"$image_url\" --platform \"$arch\"\nelse\n /usr/local/bin/preflight check container \"$image_url\"\nfi\n", "volumeMounts": [ { "mountPath": "/artifacts", "name": "pfltoutputdir" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" }, { "mountPath": "/auth", "name": "auth", "readOnly": true } ], "when": [ { "input": "$(steps.introspect.results.artifact-type)", "operator": "in", "values": [ "application" ] } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "PARAM_IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-yoqc/gl-test-custom-branch-qtsekv:219b80c26cab889ef11052f7ffaa2bd3be8df61e" } ], "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "app-set-outcome", "results": [ { "description": "The overall outcome of this task.", "name": "test-output" }, { "description": "Processed image digests.", "name": "images-processed" } ], "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\n\n# Declare Supported architectures\ndeclare -a SUPPORTED_ARCHES=(amd64 arm64 ppc64le s390x)\n\nskopeo_retries=3\n\n# Initialize result vars\nPFLT_PASS_COUNT=0\nPFLT_FAIL_COUNT=0\nPFLT_ERROR_COUNT=0\nPFLT_RESULT=\"SUCCESS\"\n\n# Loop over SUPPORTED_ARCHES and process results\nfor ARCH in \"${SUPPORTED_ARCHES[@]}\"\ndo\n # Check if results directory exits\n RESULT_JSON_PATH=/artifacts/${ARCH}/results.json\n if ! [ -f \"${RESULT_JSON_PATH}\" ]; then\n continue\n fi\n # Process results\n if jq -e '.passed == false' \"${RESULT_JSON_PATH}\" \u003e /dev/null; then PFLT_RESULT=\"FAILURE\"; fi\n PFLT_PASS_COUNT=$((PFLT_PASS_COUNT+$(jq -r '.results.passed | length' \"${RESULT_JSON_PATH}\")))\n PFLT_FAIL_COUNT=$((PFLT_FAIL_COUNT+$(jq -r '.results.failed | length' \"${RESULT_JSON_PATH}\")))\n PFLT_ERROR_COUNT=$((PFLT_ERROR_COUNT+$(jq -r '.results.errors | length' \"${RESULT_JSON_PATH}\")))\ndone\n\n# Mark as ERROR if no results were recorded, which can occur when an unsupported or malformed\n# architecture is parsed from the `platform` parameter.\nif [[ $PFLT_FAIL_COUNT -eq 0 ]] \u0026\u0026 [[ $PFLT_PASS_COUNT -eq 0 ]] ; then PFLT_RESULT=\"ERROR\" ; fi\n\nif [[ $PFLT_ERROR_COUNT -gt 0 ]]; then PFLT_RESULT=\"ERROR\" ; fi\nPFLT_NOTE=\"Task preflight is a ${PFLT_RESULT}: Refer to Tekton task logs for more information\"\n\n# Generate TEST_OUTPUT\nTEST_OUTPUT=$(jq -rce \\\n--arg date \"$(date +%s)\" \\\n--arg note \"${PFLT_NOTE}\" \\\n--arg result \"${PFLT_RESULT}\" \\\n--arg successes \"${PFLT_PASS_COUNT}\" \\\n--arg failures \"${PFLT_FAIL_COUNT}\" \\\n--arg warnings \"0\" \\\n--null-input \\\n'{ result: $result,\n timestamp: $date,\n note: $note,\n successes: $successes|tonumber,\n failures: $failures|tonumber,\n warnings: $warnings|tonumber\n}')\necho -n \"${TEST_OUTPUT}\" | tee \"/tekton/steps/step-app-set-outcome/results/test-output\" /artifacts/konflux.results.json\n\n# Generate IMAGES_PROCESSED\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$PARAM_IMAGE_URL\"'\", \"digests\": [%s]}}'\ndeclare -a digests_processed=()\n\n# Extract processed image digests from \"/artifacts/$arch/cert-image.json\"\nwhile read -r cert_image_file; do\n docker_image_digest=$(jq -r '.docker_image_digest' \"$cert_image_file\")\n if [[ -n \"$docker_image_digest\" \u0026\u0026 ! \" ${digests_processed[*]} \" == *\" \\\"$docker_image_digest\\\" \"* ]]; then\n digests_processed+=(\"\\\"$docker_image_digest\\\"\")\n fi\ndone \u003c \u003c(find /artifacts -type f -name \"cert-image.json\")\n\nretry skopeo inspect --raw --retry-times \"$skopeo_retries\" \"docker://${PARAM_IMAGE_URL}\" \u003e /tmp/raw-manifest.json\nimage_digest=\"sha256:$(sha256sum \u003c /tmp/raw-manifest.json | awk '{print $1}')\"\nif [[ ! \" ${digests_processed[*]} \" == *\" \\\"$image_digest\\\" \"* ]]; then\n digests_processed+=(\"\\\"$image_digest\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\nfinal_output=\"${images_processed_template/\\[%s]/[$digests_processed_string]}\"\necho -n \"${final_output}\" \u003e \"/tekton/steps/step-app-set-outcome/results/images-processed\"\n", "volumeMounts": [ { "mountPath": "/artifacts", "name": "pfltoutputdir" } ], "when": [ { "input": "$(steps.introspect.results.artifact-type)", "operator": "in", "values": [ "application" ] } ] }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "final-outcome", "results": [ { "name": "test-output" } ], "script": "#!/usr/bin/env bash\n\nset -o errexit\nset -o nounset\nset -o pipefail\nset -o xtrace\n\nif [[ ! -f /mount/konflux.results.json ]]; then\n printf \"Unable to populate the right test log output because the artifact's type is not recorded correctly. Please file a bug.\" | tee \"/tekton/steps/step-final-outcome/results/test-output\"\n exit 91\nfi\n\ntee \"/tekton/steps/step-final-outcome/results/test-output\" \u003c /mount/konflux.results.json\n", "volumeMounts": [ { "mountPath": "/mount", "name": "pfltoutputdir" } ] } ], "volumes": [ { "emptyDir": {}, "name": "pfltoutputdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "auth" } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }